# Pass 2 proof audit

Context: [#17885](https://github.com/pingdotgg/t3code/pull/17885), [#22033](https://github.com/pingdotgg/t3code/issues/22033). Read-only audit on 2026-10-24 of local head ea3642a4872efa089663fff337bd6283c52e17be against base 27e0c684c585f955252d65f06206dd11a143bff5. Worktree was clean. No edits to the checkout, tests, servers, browsers, forge calls, pushes, or new review delegation. This report alone was written outside the checkout and uploaded. PR registration in T3 was performed.

The supplied [evidence index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/855fb0736961017d/evidence-index.md) updates the original proof matrix. Its red-test and runtime-after artifacts close the primary missing proof identified in pass 1. Evidence is sufficient for the reported held-queue wake-latch failure and its observed native subagent consequence at this local head. This is a proof-sufficiency verdict, not a new general code-review or remote-head merge-readiness verdict.

| Matrix row / requirement | Evidence checked | Assessment |
| --- | --- | --- |
| Exact-base red | exact-base-red.log: test checkout 073cb40f90d87b5e4c30db5ff0e905691fd4ad7c, base recorded, exit 1; failure is assert.notEqual(wake.queueHeld, true), actual true. Git diff confirms the checkout differs from base only by the 74-line runtimeLayer test. | Sufficient. Exact production base plus test-only reproduction; do not call the test checkout itself the base SHA. |
| Exact-head green | exact-head-green.log: full head before/after, selected test passes, exit 0, 1 pass/86 skipped. Test content is identical between red checkout and head. | Sufficient; same test exercises the corrected scheduling boundary. |
| Claude buffered wake beside held user work | Before: wake 4 queued+held after root 3 completed. After: root 3 completed 10:51:30.746Z; wake 4 requested 10:51:30.716Z, started 10:51:32.295Z, completed 10:51:36.132Z. | Sufficient native before/after for the reported scheduling failure. Root completion follows wake request by 30 ms. Snapshot does not show wake's original queueHeld field. |
| Held user run 2 | After projection: same thread, ordinal 2 queued, queueHeld=true, null startedAt/completedAt. Exact-head test deep-compares held run before/after wake promotion. | Sufficient combined evidence for preservation. Native final snapshot alone cannot prove every intermediate field was unchanged. |
| Native subagent outcome and later wake | After native start and final notification both identify a6e4d76ef03e6d065, same tool_use_id and session. Projected subagent nativeTaskRef matches; runId is ordinal 4; status completed, result PROBE_22033_OK, completedAt 10:53:24.070Z after notification 10:53:24.068Z. Wake 6 starts 10:53:24.171Z and completes 10:53:25.678Z. Before native a38eeaf5b4c5ef5a1 receives completed notification but matching projected row remains running/null result/null completedAt. | Sufficient same-task correlation within each reproduction and evidence that a later wake is no longer swallowed. Before and after use different task IDs, as separate runs should. |
| Stop control | Fresh focused-controls.log: committed-Stop/pre-interrupt service integration passes; source asserts held follow-up/wake, interrupted root and one provider start after worker drain/resume. | Partial automated; native Stop race NOT RUN. Scheduler resume in this fixture is not explicit user Resume. |
| Codex fresh-text continuation | Adapter diff sets commandExecution offer delivery=message_text. Fresh service test checks server source, text and notification preservation; exact-head runtime test keeps a server-owned continuation held. | Partial automated/compositional proof. No direct commandExecution delivery assertion; native Codex completion, actual fresh prompt, explicit release and exactly-once delivery NOT RUN. Native-child delivery assertion is a different offer path. |
| Queue release control | Native after proves eligible buffered wakes proceed beside held user work. Fresh controls do not demonstrate explicit client Resume releasing held user/fresh-text work. | Explicit release control UNVERIFIED here; do not conflate scheduler resume with user release. |
| Failed/interrupted worktree preparation | Fresh controls: four setup cases pass. Changed test asserts late provider wake stays held after failed/interrupted setup. | Partial automated; native worktree control NOT RUN. |
| Persistence and blocking | Reviewed SQL/memory eligibility changes and added paired readiness fixture: held-only false, unheld queued true, running false, held row unchanged. | Source/test coverage present. Its passing execution is in supplementary aggregates, not the fresh selected controls; no newly SHA-bound execution claimed for this row. Full archived/deleted/preparing/starting/waiting matrix was not freshly executed. |
| Visual/render implementation | All seven changed files are server implementation/tests. No render/client/contract/CSS file changes. | Changed-render-path matrix empty. Behavioral consumers on web, desktop and mobile remain relevant; no client visual or cross-client runtime verification claimed. Screenshots not relevant to this proof requirement. |
| Other providers / connection modes | Shared scheduler applies; Codex has adapter change; no other adapter or transport changes. | No native Cursor/Grok/OpenCode/Antigravity or local/relay/tunnel parity claim. No new tests demanded solely for unchanged paths. |
| Prior aggregate validation | 257+52=309 scoped passes; separate 269-pass changed-check log overlaps and reports files changing. | Supporting only. No immutable start/end provenance; never sum these totals or describe them as fresh exact-head verification. |

Runtime provenance is lead-supplied: Linux fs-27, Claude CLI 2.1.303/Sonnet 5.5, isolated application, real native provider, no injected frames/stubs. The after extractor reads SQLite read-only and filters native logs by thread; it labels the commit from its argument, rather than independently measuring the running process's source SHA. Thus native SHA attribution is supplied capture provenance, not cryptographic/process attestation. The red/green/control logs have stronger explicit start/end SHA binding. No claim about the current remote PR head is made.

Concrete unsupported claims to avoid: all behavioral rows verified; native Codex or Stop controls passed; every intermediate queue field preserved; exactly one native start proven from the final snapshot; the provider's narrative that its background timer was still pending (the native completion timestamp precedes that reply); full issue replay coverage without a held queue. The cached issue also describes an adapter-only idle-launch/late-progress replay needing no held run. This seven-file patch and native held-queue reproduction do not establish that distinct replay is fixed. The sufficient verdict is confined to the explicitly reported held-wake/later-notification scenario, not every historical manifestation of a Running subagent.

The before transcript is less richly correlated than after, but includes the exact native agent ID in both completion notification and stuck projection. The after includes thread/run/attempt/message IDs and native task/session/tool IDs. It is an extracted native-event transcript plus final projections, not a complete ordered orchestration history. Those limits do not invalidate the demonstrated red-to-green scheduler regression and real native outcome. Existing isolated Sol/Opus MERGE reviews are context, not substitutes for this evidence audit.

FRICTION | Native controls and explicit release remain partial/unverified; native SHA binding relies on supplied capture provenance; final snapshots cannot prove intermediate states or exactly-once counts; original matrix's incomplete verdict is superseded only for the stated held-wake bug by the new red/after evidence.
VERDICT SUFFICIENT