# Proof audit pass 2 — issue24416

Findings first: no blocking proof gap for the scoped Linux AppImage CLI server/mounter/mount shutdown fix.

1. HUP does not prove complete provider cleanup. Server 847607 and mounter 847597 exit, the FUSE mount and launcher workspace disappear before driver cleanup, but startup Claude probe 847909 remains at the post-exit check. The transcript preserves the original assertion failure; tracked-PID driver cleanup removes the probe. This does not undermine the scoped mount-lifetime claim. The lead must not claim all descendants/providers clean themselves up or graceful HUP handling: the released server prints `Hangup`.
2. Minor evidence-index wording overreach: R6 says squashfs-root execution was observed. Its actual record observes `--appimage-extract`, then a zombie child with empty command line, successful `t3 v0.1.2`, exit 0, no FUSE, and workspace removal. Explicit squashfs-root command-line observation exists for R5, not R6. The inspected shim and R6 output substantiate successful extraction fallback without that stronger sampling claim.
3. The after transcript combines the nine TERM/HUP run (ending in the disclosed ancillary-probe assertion failure) and the explicitly continued remainder. Its final ALL CASES PASSED line alone is not an all-cases single-run result. Per-case records, driver inspection and cleanup support acceptance.

| Requirement | Status | Evidence / qualification |
| --- | --- | --- |
| Visual matrix | PASS / empty | Zero rows: no UI surface changed. No images, video, browser or captures apply. |
| Proper red regression | PASS | Scratch final tests paired with original baseline renderer: TERM and HUP fail `expected unmounted to be mounted`; 2 failed, 4 passed. Failure is the intended lifetime assertion, not discovery or dependency setup. Reproduction script reconstructs scratch without repository edits. |
| Deterministic delayed ordering | PASS | Six-test green output; slow server waits for explicit release; final events assert stopped before unmounted. Runtime sampling is not substituted for deterministic ordering. |
| Before 9/9 Bus error | PASS | Baseline transcript records attempts 3–11, HTTP readiness, group TERM, Bus error each; extraction attempts 0–2 explicitly excluded. Baseline drivers inspected. Baseline is a shorter summarized transcript rather than the rich after recorder. |
| R1 after 9/9 TERM | PASS | Every run reaches HTTP 200, has real fuse.T3-Code.AppImage mountinfo and executable maps, exits 130 without Bus error, and has no remaining tracked PIDs/mounts or launcher tmp.* / .mount_* workspace before finally cleanup. |
| Actual mounter isolation | PASS | At readiness each actual AppImage --appimage-mount PID has PGID=SID=its own PID and PPID=launcher; server PGID/SID equal launcher. Mounter PIDs: 841530, 842391, 843199, 843711, 844202, 844710, 845571, 846419, 847114. This verifies the actual long-lived owner rather than assuming $! / setsid behavior. |
| Runtime lifetime evidence | PASS, qualified | All signal records have mapped server executable under observed FUSE mount; no recorded sample has a live mapped server with mount absent. Some runs sample server disappearance before unmount; sampling cannot prove universal timing. Tests supply causal delayed-order proof. |
| R2 HUP | PASS, scoped | HTTP 200; server 847607, launcher 847595, isolated mounter 847597; no Bus error, server/mounter/mount/workspace gone. Startup Claude survivor and driver cleanup explicitly disclosed above. |
| R3 foreground Ctrl-C | PASS | PTY controlling terminal established by setsid/TIOCSCTTY/tcsetpgrp; tcgetpgrp=848297 equals launcher group; actual byte 0x03 sent. HTTP 200, mapped FUSE server, exit 130, no Bus error or tracked leftovers. Not background ignored-SIGINT evidence. |
| R4 mounted version | PASS | Actual FUSE mount and mapped executable, t3 v0.1.2, exit 0; mount/mounter/workspace removed. |
| R5 real mount failure fallback | PASS | Controlled PATH contains setsid, omits fusermount/fusermount3; real --appimage-extract and squashfs-root CLI observed, no FUSE, version output, exit 0, clean workspace. |
| R6 missing setsid fallback | PASS, wording qualification | Controlled PATH omits setsid and retains fusermount helpers; actual extraction observed, no FUSE, version output and exit 0, workspace removed. Short-lived extracted CLI command line missed by sampler. |
| Cleanup | PASS, scoped | Per-case results precede finally cleanup, so server/mounter/mount success is not manufactured by harness cleanup. cleanup.txt reports all tracked processes/mounts absent and port connection refused. Audit-time read-only /proc recheck also finds no recorded live PID or owned mount. Provider/Chromium scratch directories remain as disclosed. |
| Runtime provenance | PASS | Renderer source 0e05de5f8d21474571644f2819d3ebf27f317681; official supplied v0.1.2 artifact, not rebuilt final desktop. Recomputed artifact SHA256 cf01e2d167eff9d01c4c1004d31b2c0da9e2522cc94262e41644d1cb15dfdb5c and rendered shim SHA256 0bd4d6aa30ea2e9b7ee3202296931a1047e7ab2e402e2bb09d6f6b1d1c17a341 match index. Official origin is supplied provenance, not independently downloaded release verification. |
| Final-head applicability | PASS | Final c3e066d39d392f83fd1a390d5dc5da6d42da358a merges main d0e621e9f9db38816211c3fbb423a68af7e7e427 (unrelated mobile change). Both shim source/test blobs byte-identical to evidence source: 818676864da86eef1bb7ea34e41731361b02803a and c6dcb86ddcf95be873f44516baf6be96cd95cb44. |
| Exact final PR diff unchanged | PASS | SHA256 of full `git diff 6e79211743 0e05de5f8d` and full `git diff origin/main HEAD` both 238efe9089af38e92219e04b0d6208cf47905c6baf00edf01ff42afa4e08a786. Two desktop files only; diff --check passes; worktree clean. |
| Post-merge tests / lint / typecheck / reviews | SUPPLIED, not independently audited | User reports focused 6/6 after merge, lint/typecheck passing, both independent round2 reviews MERGE. Linked green transcript proves pre-merge 6/6 at evidence source; linked bundle contains no separate post-merge lint/typecheck or review transcripts. Byte identity/diff equality establish proof applicability without treating reported checks as independently inspected. |

Read local equivalents of every text link in the evidence index: reproduce.sh, evidence-driver.py, red-tests.txt, green-tests.txt, after-transcript.txt, provenance.txt, cleanup.txt, baseline transcript and pass1. Parsed the entire after transcript, inspected per-case processes/maps/mounts/events/output, and read the baseline drivers and rendered launchers. No runtime reruns, fixtures, source edits, commits, pushes, public writes, merge, delegation, browsers or capture. Only this audit report is written outside the worktree. No upload was needed.

Unverified limitations: rebuilt final desktop artifact; independent release download/signature provenance; separate server child wait status (not waitable by driver); events between runtime samples; unseen descendants escaping process polling; provider turns/all-provider cleanup; real SSH disconnect; service-manager/cgroup variants; shim-only signals; SIGKILL; macOS, Windows and direct executables; GUI/web/mobile and remote/relay/tunnel. Red/green and runtime evidence are inspected existing execution, not rerun by this auditor. These limits do not expand the scoped claim. The isolated local state, explicit group recipient, shell/setsid/OS details and cleanup are recorded; exit 130 and reconciliation logs alone are never accepted as proof.

FRICTION category|what|prevention

- Evidence wording|R6 command-line sampling claim exceeds recorded observation|Describe observed extraction plus output/status; distinguish inferred execution from sampled command line.
- Scope|HUP probe survives although server/mounter/mount clean up|Keep provider cleanup explicitly excluded; never summarize this as all descendants self-cleaning.
- Transcript continuity|Earlier driver assertion and continued remainder coexist with final success banner|Read individual case records and preserve the failed assertion and continuation explanation.
- Provenance|Runtime evidence precedes unrelated main merge|Record evidence SHA, compare source/test blobs and exact full PR diff; do not relabel runtime as rebuilt head.
- Verification provenance|Post-merge checks/review verdicts are reported but absent from linked text bundle|Label them supplied; retain exact-head check/review transcripts when claiming independent audit.

VERDICT: SUFFICIENT — real mounted-runtime before/after evidence plus proper red/green ordering proof covers the unchanged final shim diff; acceptance is limited to server/mounter/mount lifecycle and excludes all-provider cleanup.