# Proof audit pass 2 — worktree fetch timeout

## Findings first

No missing or contradicted required proof rows for the specified local committed implementation. The original pass-1 matrix was stale: it named an older base and dirty implementation and marked evidence pending. The corrected matrix below replaces those claims. This verdict covers the local committed pair, not an assertion that the original remote PR contains this replacement.

One clarification to “what else changed”: the 300,000ms option also causes execute's existing `timeoutMs > DEFAULT_TIMEOUT_MS` branch to bypass the short-command semaphore. That is consistent with the original PR description and the intended long-operation policy. It is implicit behavior of the timeout change, not an additional source edit. Retry/fallback, timeout diagnostic, checkout/removal and other fetch helper code are unchanged. The bound is **per fetch attempt**, not a total worktree deadline. A ref-lock exit may cause a retry, and the public fetchRemote missing-ref path may start an all-refs fallback. A truly hung first attempt times out without either path.

## Exact provenance and scope

Target: [#18537](https://github.com/pingdotgg/t3code/pull/18537), [#18537](https://git.cafe/pingdotgg/t3code/pulls/18537).
Before: replacement merge-base [7fd2e09e38](https://github.com/pingdotgg/t3code/commit/7fd2e09e381a61f427da09dd7a8f2c9c1558fe59).
After: [cefc1ace94](https://github.com/pingdotgg/t3code/commit/cefc1ace94bfe0d9f0bd97655a899fc4eccdffe3), branch `takeover/pr-18537`, clean before/after audit.
`git merge-base` confirms the exact requested before commit. The entire before/after diff is two files, 46 insertions: four production lines (constant/comment/options) and 42 lines in the existing driver test file (TestClock import and two parameterized cases). No other application files, contracts, clients, adapters, configuration or dependencies changed.

Git blobs independently verified against test provenance: baseline production `5a9aa74af60aaff36eccb501cf0290a3b0fb180d`; final production `017f61ec848b26f5ca12c22be5e266e410961300`; final test `9679f7f41693e0585a618a01be04ebb4ff931824`. The original contributor [e0882fad91](https://github.com/watson/t3code/commit/e0882fad916b3a5f9020313149a87e503aa5ddae) also uses a fixed constant, not a configuration knob.

Only `/home/ubuntu/wt/pr-18537` was used for application source. No source edits, commits, branch switches, pushes, PR creation, comments, watches, browsers, live userdata access or other application worktrees in this audit. Artifacts and fixture-only Git repositories are outside the checkout. Read repo AGENTS.md, proof-audit brief and EVIDENCE standard; explicit server transcript override replaces visual/pixel requirements.

## Artifact verification and transcript audit

Downloaded all 14 supplied public artifacts via curl: index, stale matrix, three runtime transcripts, scoped tests, reproduction guide, three capture scripts, test script, cleanup script/JSON and hash manifest. All 13 index artifacts byte-match local sanitized copies; the public matrix matches the separately supplied local matrix. All 11 manifest entries match SHA-256. The manifest and index are not self-hashed; byte comparison verifies those supplied copies. This is content integrity, not a cryptographic signature of origin.

Read transcript contents, complete RPC setup streams/projections, driver events, server logs, capture/RPC/wrapper code, test failure details and cleanup records; not just file structure. No credential values, cookies, token-bearing pairing links, private keys or live user data found in published material. Server auth startup lines are redacted; scripts generate credentials in memory. Provider model slugs and synthetic fixture identities are harmless test data. Pattern checks supplement manual reading; they are not a claim of universal secret detection.

Recomputed transport-start to terminal timestamps directly from transcript contents:

| Row | Delivered semantic evidence | Audit status |
|---|---|---|
| R1 before | Healthy 37s wrapper; failure at 30.032391s, timeout diagnostic, only original worktree | PASS |
| R1 after | Same topology/content/delay; done at 37.278359s, HEAD=fresh B | PASS; independently rebuilt |
| R2 after | Wrapper uses indefinite signal.pause, no own deadline; live at 68.7/139.9/270.7s; fails at 300.051576s; clear timeout; no new worktree | PASS |
| T1 | Baseline fails `timed out` vs `fetched`; final passes virtual 31s completion | PASS |
| T2 | Baseline already settled by 299s; final pending at 299s then timeout at 300s | PASS |
| S1 | Real launchThread startFromOrigin=true reaches scoped fetchWorktreeBaseCommit before checkout | PASS |
| S2 | Shared options cover scoped/unscoped/retry/fallback; existing full-file tests exercise retry and real missing-ref fallback | PASS |
| U1 | No-fetch strategies and missing fetchable remote gated in ThreadLaunchService | UNCHANGED, source inspected |
| U2 | Immediate errors/ref/path/collision branches unchanged | UNCHANGED; existing tests, no new capture required |
| U3 | Direct worktree RPC/checkout/removal/setup separate unchanged paths | UNCHANGED; not substituted for regression proof |
| U4 | Other fetch helpers/status/push separate execute paths | UNCHANGED, no blanket timeout claim |
| U5 | Client/platform/provider/relay UI code unchanged | N/A under server-only override |

Launch RPC acceptance was not treated as completion: transcripts follow subscribeWorktreeSetup through done/failed and request the final projection. No initialMessage/setup script is supplied; projections show no provider sessions/turns. Fixtures' bare remote main B was independently read from disk and checked against each transcript; A equals initial local HEAD and cached origin and differs from B. Healthy-after worktree HEAD equals B; failed cases show no new worktree. Independent read-only fixture verification corroborates the transcript freshness claims.

## Independent rebuild

Used the uploaded capture.py, rpc-client.mjs and upload-pack.py, downloaded and hash verified. Only driver adaptations outside repo: OUT points to audit artifact directory; branch-switch statement replaced by assertions that current branch and HEAD already equal the final pair. No production override. RPC and wrapper bytes unchanged. Driver diff is included in the audit bundle. New unique home `/tmp/ev-18537/audit-healthy-pass2-isolated-20261024/home`, no seeding/copying live data.

Same environment: Linux fs-01 x86_64 kernel 6.1.102, Node v26.12.1, Git 2.43.0; real vp dev runner, server 127.0.0.1:15913 and web 7873. No browser/tool/device emulation/DPR/font/viewport/theme applies. Actual git-upload-pack pauses 37s, then transfers fresh B. Result: **done in 37.218175s** from transport start; fetch stage 37.164s; HEAD and B both `a6228d17dc5a3e4d997ab7bcbe477940e50e00ca`. Delivered 37.278359s; delta **-0.060184s**. Semantic delta is zero after normalizing fresh fixture IDs/hashes and timestamps. The small timing delta is normal subprocess/checkout overhead, far from the 30s regression boundary. Pixel delta N/A by explicit override.

Focused independent test run on final clean source: 17 passed, 148 filtered out, 7.73s. Selected new healthy/hung tests, ref-lock retry and fetch error cases. Delivered full-file logs prove 163 pass + exactly two expected new failures against baseline production, then all 165 pass with final production. Baseline test reproduction shell deliberately changes source, so it was inspected, not rerun under this read-only scope. Added tests use Deferred/TestClock; no wall sleeps or timing assertions. The wrapper's real delay is the authorized runtime fixture, not a test-suite sleep.

## Remote freshness and delivery limits

Read GitCafe state using cafe-cli/cafe-pr skills after checking origin. PR still open at contributor [e0882fad91](https://github.com/watson/t3code/commit/e0882fad916b3a5f9020313149a87e503aa5ddae), confirmed by read-only ls-remote on contributor branch `t3/configure-worktree-fetch-timeout`. The body is about that original 166-test implementation and historical review/main SHA; it is not a description of this unpushed 165-test replacement. No claim is made that those old test/review statements validate the local replacement.

Origin main now advertises [c4fa4629eb](https://git.cafe/pingdotgg/t3code/commit/c4fa4629eb645b95aae2beef56c70f705b736049), newer than the pinned baseline; that object is not local and no fetch/merge was performed. This audit is explicitly pinned to the requested pair and does not certify compatibility with later main. Final local replacement has intentionally not been published. No remote mutation was needed to establish proof sufficiency; T3 thread PR registration only records the target in this thread.

## Cleanup and FRICTION

First independent replay was interrupted by a dev watch restart at 23:37:09 while focused tests ran concurrently. It did not reach 37s and is excluded. The source stayed clean; the trigger was not conclusively identified. Stopped its recorded client group, letting driver finally clean its recorded transport/server group. Reran the same driver alone under a second unique home; that completed successfully. Do not run checks beside a watch-mode runtime capture.

Verified all six audit-recorded server/client/wrapper PIDs absent, both owned server process groups without remaining members, capture ports 15913/7873 closed, branch unchanged at final SHA and git status empty. Delivered cleanup JSON likewise records all earlier captured processes absent, no group members and closed ports; source and provenance match. Fixture homes remain outside repo for inspection, not running. No broad process matching/killing used.

Other FRICTION: stale matrix required replacement; original remote body/head intentionally remains unchanged; current main advanced since pinned base. urllib403 fallback documented by capture owner; this audit used curl successfully. First source search guessed Services/Layers directories that do not exist; corrected to actual flat module paths. No required proof rows remain missing.

## Published audit artifacts

- [Corrected matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/5a4e8cb3acc15fc1/corrected-matrix.md)
- [Independent replay transcript and cleanup](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/82c91d89c38ff867/independent-replay.md)
- Supporting scripts, validation JSON, focused test log and interrupted-attempt logs are included in the audit bundle, with SHA-256 manifest. All files are outside the repository.

VERDICT: SUFFICIENT