Findings first:

1. **No missing or contradicted proof rows remain for [#32524](https://git.cafe/pingdotgg/t3code/pull/32524) at [45db81569d](https://git.cafe/pingdotgg/t3code/commit/45db81569d379dd042036095432c640f8e5ba46d).** The checkout was clean before and after verification. Its merge-base with the local origin/main ref is [d313b2aff3](https://git.cafe/pingdotgg/t3code/commit/d313b2aff31991ab94c8ac80cdc38a54dd575604). I read both complete supplied transcripts, the after driver and complete before/after driver diff, all three capture reports, the earlier audit report and matrix, the complete four-file PR diff, and the addendum's changes in context. Unchanged coverage is carried forward with the limits stated below.
2. **F1 is current and comparable.** The [before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1bc92f7e3fe438a0/before.txt) identifies the base commit; the [after transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/452505ff50510827/after.txt) identifies the reviewed head. The addendum supersedes the original brief's older after-SHA instruction. Both use fresh isolated databases with seeding disabled, one server bootstrap thread, a synthetic project and idle A/B with null worktree paths, the same Simlock host configuration, and a named Pixel 9 / Android API 36 fixture on Linux x86_64 with Node v26.12.1. Both confirm persisted thread.settled sequence 7. Before observes A still present after successful cleanup: aSessions=1, deviceStillBooted=true, zero cleanup close child spans. After observes A absent at device revision 14, a successful DeviceService.close under the completed releaseSettledThreadDevices span, then aSessions=0 and deviceStillBooted=true. Fixture close/shutdown occurs only after F1 PASS. B opens on both sides; that does not establish exclusive local claim transfer.
3. **The changed observation is fair.** Apart from scratch paths, the after driver additionally observes the asynchronous release trace, waits for successful release and close plus a newer device state without A, and counts closes below the release span. Its waits are bounded event/trace milestones. Before's observation follows persisted settlement and completed cleanup; the inspected base has no settlement device-release path that would finish later. The uploaded transcripts match the local capture files byte-for-byte. The after driver matches capture2 and capture3 byte-for-byte (SHA256 6f4222638329de990a2294b88c32136749bf00dde7e8cc176d958de5fe17372a). The capture3 shim only redirects the scratch path. No new runtime capture is needed.
4. **F7's old wording must be retired.** The current test is `keeps the devices of a thread re-engaged while a release waits on the lock`. Its Deferred barrier models the lifecycle-lock wait; after re-engagement it asserts zero releases for A, including the first device. The real DeviceService test additionally verifies that when=false leaves both caller and peer sessions intact. Source inspection confirms the guard is evaluated inside lifecycleLock.withPermit before session selection or release, and ProjectionStore.getThread performs a fresh read when the effect runs. This is composed unit proof plus source inspection, not a live SSH race reproduction.
5. **The PR body has already been refreshed.** GitCafe returned description version 16, updated 2026-11-10 15:08:02 UTC: the head, timestamp, asynchronous release behavior, renamed F7 test, and when guard are current. The remaining wording corrections below clarify the evidence; they are not missing implementation proof.

Verification rerun in the requested checkout:

- `vp test run apps/server/src/orchestration-v2/ThreadSettlementService.test.ts`: **39 passed**, exit 0.
- `vp test run apps/server/src/device/DeviceService.test.ts -t 'agent session release on close'`: **11 passed**, 52 excluded by name filter, exit 0. This includes the added when=false assertion. I did not rerun all 63 DeviceService tests or check:changed; those broader claims in the body are not independently certified by this audit.
- Existing own-agent-settlement runtimeLayer and shared-host-lease tests remain present and were inspected, not rerun, as in the earlier audit.

| Row | Status | Evidence at the reviewed head |
| --- | --- | --- |
| F1 Healthy single-device settle | COVERED — runtime + unit | Current before/after above; `releases a settled thread's devices without shutting them down` passes. |
| F2 Empty sessions | COVERED — unit | `leaves the device service alone for a settled thread without devices` passes: no closes; script starts. |
| F3 Several healthy devices | COVERED — composed unit | Exact two-device iteration in `releases the other devices and runs the settle script when one release fails`, healthy F1 unit, and successful DeviceService close. No separate two-success runtime capture claimed. |
| F4 Earlier release fails | COVERED — unit | `releases the other devices and runs the settle script when one release fails` and `retains an SSH record during reconnect and releases it on retry` pass. Failed sessions may remain; later release/script proceed. |
| F5 Re-engaged before cleanup | COVERED — unit + guard | `keeps the terminals of a thread re-engaged before the event ran` passes; initial return precedes release scheduling. |
| F6 Re-engaged during terminal close | COVERED — unit | `skips the settle script for a thread re-engaged while its shells close` passes, including zero device closes after drain. |
| F7 Re-engaged while first release waits on lock | COVERED — updated unit + DeviceService boundary | `keeps the devices of a thread re-engaged while a release waits on the lock` passes: both A devices retained. Real close test's when=false assertion passes; actual guard placement under lock inspected. Replaces the old first-device-closes/second-retained expectation. |
| F8 Valid own worktree | COVERED — unit; corrected ordering | `runs the settle script in the thread's own worktree` passes. Release is scheduled before the worktree/script gates, but finishes independently; completion before script start is not promised. |
| F9 Null/missing worktree | COVERED — composed proof | Shared/missing/valid worktree test passes; release scheduling precedes filesystem gate. F1 proves actual release with null worktree. |
| F10 Repeat settlement / script retry | COVERED — unit + inspected guard | `runs the settle script once when a settlement is re-emitted`, `retries the settle script on a re-emitted settlement after a failed start`, and close idempotence pass. Unchanged invalid-timestamp guard inspected. |
| F11 Settlement origins | COVERED — convergence + unit | `skips settings and PR decisions for recent branchless threads`, `settles a merged pull request stored only in the thread links`, and `reevaluates immediately after a pull request merge` pass. Common thread.settled consumer unchanged; own-agent deferral runtime test inspected, not rerun. |
| F12 Local claim / peer isolation | COVERED — DeviceService boundary tests | `releases only the caller's session, keeps the device booted, and is idempotent` and `accepts a missing agent session, shutdown=%s` pass. Shared-host-lease case inspected, not rerun. Pool runtime proves session removal, not exclusive local claim transfer. |
| F13 Other thread's settle cleanup while release waits | COVERED — regression unit | `closes another thread's terminals while a device release waits on the lock` passes. It observes other-thread terminal cleanup before freeing the Deferred barrier, then drains and verifies both releases. |

Exact PR-body wording corrections against fetched version 16:

1. Replace the runtime paragraph's sentence beginning “The same RPC driver ran on both sides” with: “Both drivers use the same fixture and RPC sequence: create A, open its device, settle A, and await persisted thread.settled plus successful cleanup. The after driver additionally awaits the asynchronous release, its successful DeviceService.close span, and a newer device-state update without A before reading the sessions.” This avoids implying that the before run waits for a release absent on main; the later parenthesis already acknowledges the driver difference.
2. Replace the runtime paragraph’s before/after revision sentence with linked commits: “Before is the main merge-base at [d313b2aff3](https://git.cafe/pingdotgg/t3code/commit/d313b2aff31991ab94c8ac80cdc38a54dd575604); after is [45db81569d](https://git.cafe/pingdotgg/t3code/commit/45db81569d379dd042036095432c640f8e5ba46d).” The existing SHAs themselves are current.
3. Replace “the tests above cover them with a held lock” with: “Settlement tests model the lock wait with Deferred barriers; the DeviceService test verifies that a false when guard retains both sessions. The guard's placement under the actual lifecycle lock is verified by source inspection.” The settlement harness mocks close; it does not hold the real DeviceService lock during the race.
4. Relabel the linked “proof matrix” as “historical pass-1 proof matrix” and append: “F1 is superseded by the current transcripts above. F7 now retains both devices when the thread re-engages while waiting for the lock. F8 schedules release before the script gates but does not await release completion.” Alternatively replace that historical attachment with this current report after the lead uploads it. Its old MISSING-F1 verdict, old F7 expectation, and synchronous F8 ordering should not look like current proof.

No source edits, pushes, comments, servers, worktrees, or leases were created. Both spawned test commands exited successfully; there are no processes to stop. Evidence and logs remain only under /tmp/lead-32524-r1/audit-3/. Final free space: 105 GB. This is a proof audit, not a merge-readiness verdict or certification of all CI claims.

FRICTION: none

VERDICT: SUFFICIENT