# Final evidence audit pass 2 refresh

No blocking proof defect. Refreshed final-head evidence is sufficient, with no semantic delta from the independently rebuilt prior pass 2. This is an evidence audit, not a new code review or CI verdict.

Scope: takeover [#19738](https://git.cafe/pingdotgg/t3code/pulls/19738), replacement [#24617](https://github.com/pingdotgg/t3code/pull/24617), branch `takeover/pr-19738`, sole checkout `/home/ubuntu/wt/pr-19738`. Exact head [221f4bed6f](https://github.com/pingdotgg/t3code/commit/221f4bed6f43c2b7e1a3a3efcce778c9cb822468) (`221f4bed6f43c2b7e1a3a3efcce778c9cb822468`); exact base [8bcef34f16](https://github.com/pingdotgg/t3code/commit/8bcef34f16ca2a08aa19c35dd64b71290bd4412f) (`8bcef34f16ca2a08aa19c35dd64b71290bd4412f`). HEAD and clean tracked state independently verified before/after. Settlement implementation/tests have zero diff from reviewed [9da6ba5f1f](https://github.com/pingdotgg/t3code/commit/9da6ba5f1fe6d66ecc4e734d38276451f0b9ab78). Exact base→head changes only those two files, validating identical remaining runtime inputs for the base build hook. Current upstream Orchestrator, ProjectionStore and dev-runner are included in the rebuild.

Read the final [index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c3b880a456e2b5cb/final-head-index.md), [transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bfe410ade0bd484a/final-head-transcript.md), local original matrix, manifest, scripts, raw final base/head RPC, diagnostics and lifecycle records, and [prior independent audit](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ad1a946a191b47a6/pr-19738-proof-audit-pass2.md). Public index/transcript match local bytes. All 27 advertised SHA256 entries verified using local bytes or immutable public downloads where this replay replaced scratch outputs. Delivered assertion/sweep/lifecycle records match manifest records exactly. The updated build hook loads the pinned service once, derives normal pack settings from the checkout, writes only scratch outputs and does not swap tracked source.

Independent command: `python3 /tmp/ev-19738/replay.py head`. Used the final updated scripts unchanged, archived prior fixture runtime data, rebuilt final head, created fresh isolated userdata, then executed seed/pre/advance/restart/durability. Explicit `--home-dir /tmp/ev-19738 --no-seed --no-browser --no-auto-bootstrap-project-from-cwd`, `T3CODE_DEV_SEED=0`. No live userdata read or write. All delivered final-head bundle hashes match independent rebuild output byte-for-byte.

Actual pre-threshold completed sweep: 2026-10-25T00:15:46.769Z, D=3, all three candidates unsettled. External Date.now offset +345600000ms and real settings RPC D=2 triggered completed sweep at real 00:15:47.739Z / logical 2026-10-29T00:15:47.739Z. Only retention-off known-open persisted-link thread settled. Its link remains open and settledAt equals original createdAt. Retention-on project override and null-snapshot controls remain unsettled. Restart completed sweep at real 00:15:55.714Z / logical 2026-10-29T00:15:55.714Z includes both remaining controls. All 12 projection assertions passed, including durability. Read-only active event-store extraction confirms exactly one thread.settled, server actor and server:auto-settle:proof-open command, zero message/run/provider activity. No manual settlement command. Raw projections also confirm no legacy aliases, branch/worktree, archival, pin or snooze. Sweep completion logging follows awaited dispatches; timeouts are failure ceilings, not absence proofs.

Fixture row sufficiency:

- P1 core regression: SUFFICIENT. Refreshed exact-base completed sweep preserves unsettled state; refreshed head and independent head settle only the eligible open-link thread. Prior base-red/head-green deterministic proof carries forward.
- P2 retention: SUFFICIENT. Project override keeps known-open control active through completed sweeps and restart, independently reproduced.
- P3 unknown: SUFFICIENT. Null snapshot remains conservative through completed sweeps/restart; prior unknown/mixed ordering deterministic coverage carries forward.
- P4 terminal shortcut: SUFFICIENT. Prior merged/closed lookup, merge toggle, retention and age parameterization carries forward with byte-identical implementation/tests.
- P5 mixed links: SUFFICIENT. Prior both-order open/terminal and unknown-priority proof carries forward.
- P6 boundary/anchor: SUFFICIENT. Prior exact boundary/latest activity/wake/sync coverage carries forward; final live anchor independently equals createdAt.
- P7 disabled inactivity: SUFFICIENT. Prior null-D cross-product carries forward; fresh runtime begins with inactivity disabled before enabling it.
- P8 candidate protections: SUFFICIENT. Prior blocker/eligible/non-holding controls carry forward; no new live cross-product claimed.
- P9 unaffected terminal/no-link paths: SUFFICIENT. Prior terminal ordering, historical/dismissed/legacy and merge toggle proof carries forward.
- P10 worker entry points: SUFFICIENT. Final settings trigger and restarted activation independently reproduced against updated runtime. Prior deterministic initial/settings/periodic/link/sync and project override proof carries forward.
- P11 committed state/races/consequences: SUFFICIENT. Final committed event, no-activity history and restart independently reproduced against updated Orchestrator/ProjectionStore. Prior race/override/cleanup proof carries forward. No fixture scripts/worktrees/providers.

Comparison: delivered exact base has zero settlement; delivered final head and independent final head have one eligible automatic settlement and identical 12 phase/thread/state assertions. Expected variable timestamps, UUIDs and PIDs differ. No semantic delta from delivered final head or prior independently replayed head. Rows carried forward above were not rerun as new tests; no broader suite requested or added. Server transcript semantics are the proof; screenshots/pixel comparisons/client rendering are N/A.

[Independent replay summary, sweeps, lifecycle and committed settlement](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/32f08a662ee43da7/final-audit-replay-summary.json).

Cleanup: owned runner PIDs 1775408 and 1776090 and all 10 captured process-group PIDs exited through pidfd barriers and are absent from /proc. Port 19738 closed. HEAD unchanged, worktree clean. No source swaps, edits, commits, pushes, forge comments, watches, browser, new checkout or live userdata access. Replacement registered in T3 as required by harness and verified unwatched; no forge state mutation.

FRICTION: No new execution failure. Existing logical-clock/GraphQL/observational bundle hooks remain required and inspected; this is accelerated logical time, not four wall-clock days. Replay archives fixture userdata and overwrites scratch build/SQL outputs; immutable delivered records were retained and compared, with public downloads used to verify overwritten advertised bytes. Prior capturer module-resolution retries occurred before servers and do not undermine successful final captures. No unresolved proof gap.

Model/harness: gpt-6.1-sol through Codex in T3 Code. Skills: pr-audit and ghdrop.

VERDICT SUFFICIENT