# Proof audit pass 2

VERDICT: SUFFICIENT for the core Claude /clear → completed B turn → server restart → answer-in-B incident at the pinned issue patch. This is artifact coverage verification, not a fourth implementation review or merge-readiness verdict.

PR [#24168](https://git.cafe/pingdotgg/t3code/pulls/24168); incident [#24153](https://git.cafe/pingdotgg/t3code/issues/24153), mirrored as GitHub [#24152](https://github.com/pingdotgg/t3code/issues/24152).

Audited head [f7828e7c2e](https://git.cafe/pingdotgg/t3code/commit/f7828e7c2edf5fe421335c0a285b95cc40a1ad86), base [bb7783e295](https://git.cafe/pingdotgg/t3code/commit/bb7783e295506ad423f527ed28a019836e331e8c). HEAD and clean status verified before focused test execution and again during this audit. A subsequent merge of current main is outside this verdict.

## Stable findings

### PASS2-01 — CLOSED: core final-head runtime gap

The [fresh stable runtime bundle](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/53c2e1c0c57bc0c7/stable-final-runtime.txt) records the exact frozen head in both stages. I read the complete bundle and its [capture script](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b852de930b4c148e/capture-stable-final.py), and read the local stage-1 artifact before the final bundle arrived.

Thread `7b283dc3-2443-430f-99b3-3ef52ca56965` used A `2fe1a860-d7a0-45bb-bd89-7b2ebc736256`, then /clear selected B `9afda25c-14c8-4af4-ad2b-724043d854b5`. Stage 1 records persisted B under the stable T3 provider-thread ID, and a normal B/Q9 turn completed at 11:53:30.873Z. The lead reports stopping server PID 88372 and restarting PID 76934, ready at 11:54:27 UTC, after Q9 completed and before the follow-up.

Run 4 requested at 11:55:25.940Z completed at 11:55:30.050Z. Its sole attempt names B, reason initial, status completed. B's actual JSONL records contain the user follow-up at 11:55:27.920Z and assistant response `You answered "Q9: is the sky blue?"` at 11:55:29.818Z. The final persisted provider thread still names B, idle, lastRunOrdinal 4, with the same T3 provider-thread identity as stage 1. A's 575090-byte transcript has matching before/after SHA-256 `70db3a3c51019e7fa8386ebd133a32b58bf93341a023599d80fdba58ada09819`; its mtime predates the reported restart. Thus the proof goes beyond model recall or resume configuration: the actual reply was written in B and absent from unchanged A.

The script corroborates the extraction method: SQLite is opened mode=ro; rows are filtered to the designated thread; only designated A/B JSONL files and exact test markers are read. The script hardcodes narrative/UI/restart claims and does not independently assert PASS. Restart PIDs/readiness and UI observations remain attributed to the lead/tester; the machine-readable run, attempt, projection, and transcript records support the routing outcome. Raw SDK query-open options, root-init frames, and parentUuid chains are not included, so this audit makes no claim to have inspected them. Their omission does not undermine this narrow outcome, which is established directly by the stored session and transcript records.

### PASS2-02 — CLOSED: final fix has meaningful deterministic evidence

The [round-3 red/green summary](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/08ea00706866fdcd/round3-red-green.txt) identifies red source [21e40c676f](https://git.cafe/pingdotgg/t3code/commit/21e40c676f5d20e399cd50460a4aaef85e94286f) and green head f7828e7c2e. Its two failures match actual final tests: the cleared query overwrites a rolled-back thread, and stale resume returns the pre-clear session. These are state assertions, not timeout-only red results. Git history confirms f7828e7 changes production adapter code while those tests are already present in its parent.

I independently ran at f7828e7:

```text
vp test run apps/server/src/orchestration-v2/Adapters/ClaudeAdapterV2.test.ts -t 'closes the cleared session|keeps the cleared session'
exit 0; 1 file passed; 2 passed, 215 skipped (217)
```

I also ran five files (ClaudeAdapterV2, ProviderSessionManager, ProviderSwitch.integration, ThreadFork.execution, CheckpointRollbackService), filtered to:

```text
persists a session cleared|persists a provider thread update|resumes the native session /clear|forks a Claude run|rolls a Claude thread|starts a fresh task list when /clear|retires a session task list after an idle /clear|keeps the session a /clear|resumes the session a /clear
exit 0; 5 files passed; 12 passed, 294 skipped (306)
```

This independently covers active/idle adoption and process replacement, runless and queued-behind-terminal persistence, restart selection, task-list fresh/shared behavior, attachment/prompt-file schedules, and historical fork/rollback session selection. The focused reruns total 14 passing tests. The supplied summary reports 418 green tests across eight files plus server typecheck and scoped lint; I did not independently rerun that entire scope or its historical reds. The summary omits exact invocations and exit codes, so preserve that provenance limitation.

### PASS2-03 — CONFIRMED: visual matrix stays empty; claims remain bounded

The aggregate base/head diff contains ten files, all under apps/server/src/orchestration-v2: five production files and five test files. I inspected production changes and relevant test assertions. There are no changed render paths, client components, contracts, styles, navigation, platform renderers, or transport/origin paths. Render fixture matrix: `[]`. No screenshot or new visual capture is required.

Runtime coverage is the authenticated Claude web/Linux incident path, provider claudeAgent/model claude-opus-5-5. It does not establish packaged macOS desktop, native mobile, relay/tunnel, every background-work migration schedule, or runtime fork/rollback. Fork/rollback coverage here is deterministic test evidence only. No blanket lifecycle/race-freedom claim follows.

## Provenance corrections

The [before artifact](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e6d64fc609517a77/before-runtime.txt) demonstrates the defect on main [fef851bee0](https://git.cafe/pingdotgg/t3code/commit/fef851bee09102641061aeb78a3092c2ba2c72ab), not on pinned base bb7783e295. It shows Q9 in B, reply in A, and persisted A. This is before/after incident evidence across those actual revisions, not an exact-base paired runtime experiment.

The [417-test summary](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b0b21904959ff1e6/final-red-green.txt) belongs to [2a93ea0a3e](https://git.cafe/pingdotgg/t3code/commit/2a93ea0a3e271cbd1f691427431cf3a99fddbb94). The [earlier combined runtime](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f0a97ddb3db5aefc/final-runtime.txt) spans 2a93ea0a3e and 21e40c676f, with an extra cancellation and recovered turn. It remains qualified historical proof and is not used as clean final-head proof. The new stable bundle supersedes it for the narrow runtime verdict.

Read the incident body and all issue comments through cafe: one comment, next=null, truncated=false. Its SDK-replay-only statement predates the new authenticated evidence. Pass 1's forge-number ambiguity is resolved by the mapping above; no GitHub API reads were used.

## Friction and scope

- urllib artifact download returned HTTP 403; curl successfully fetched every artifact. No artifact was left unread because of that error.
- Supplied runtime capture reports replacing the missing preview tab, private pairing, and initial module loading. No final-run cancellation, automatic resume, or alternate browser appears in the final proof.
- No repository edits, push, forge comments, server/browser operations, visual captures, or delegation by this audit. Only focused tests and scratch files outside the worktree. PR registered with the thread; no watcher started.
- The pending main merge and its rerun must be recorded by their own SHA. This sufficient verdict stays pinned to f7828e7 versus bb7783e295.