# Final proof audit pass 2 — repeat after repair

Proof is sufficient for all nine matrix rows and all 24 before/after subcases. The previous R9l/R9m native-history gap is repaired. This verdict concerns runtime proof for the supplied replacement head, not the original contributor branch or live forge/CI state.

Scope: [#20371](https://git.cafe/pingdotgg/t3code/pulls/20371) ([GitHub mirror](https://github.com/pingdotgg/t3code/pull/20371)), replacement `takeover/pr-20371` at [c635428d3e](https://git.cafe/pingdotgg/t3code/commit/c635428d3e05436f815263ed8c9cddc48e5b2e4f), baseline [7fd2e09e38](https://git.cafe/pingdotgg/t3code/commit/7fd2e09e381a61f427da09dd7a8f2c9c1558fe59). Original contributor [4ce461344e](https://github.com/only21mil/t3code/commit/4ce461344ebd56167af01a382dc4df6ce2eada65) is background. Local HEAD independently matches the final replacement SHA. All five changed files were inspected; their contents are identical to the prior reviewed replacement [84febd77a0](https://git.cafe/pingdotgg/t3code/commit/84febd77a02b1ac445826b1e642364439ea352f8).

## Every final row

“Ordinary” means literal submitted text inside the normal T3 instruction blocks. “Expansion” requires native first-user `<skill_information>`, fixture path/body and arguments. A marker response or assistant assertion alone is not expansion proof. Every row below has matching actual protocol input/output, native response text, ACP `end_turn`, and completed persisted run/provider-turn records.

| Row | Before | After | Result |
|---|---|---|---|
| R1 | Ordinary `$ev20371 report`; no native injected skill | Exactly one bare `/ev20371 report` text block; native skill body, `args="report"`, marker response | Sufficient |
| R2 | Ordinary `report $ev20371`; no expansion | Byte-identical outbound blocks; no expansion | Sufficient |
| R3 | Ordinary `$missing20371 report`; no expansion | Byte-identical blocks; no expansion | Sufficient |
| R4 | Ordinary `$internal20371 report`; no expansion | Byte-identical blocks; no expansion; native inspect proves `userInvocable:false` | Sufficient |
| R5 | Ordinary `$ev20371 report`; completed | Byte-identical blocks; inspect-only wrapper exit 73; native turn still completes without expansion | Sufficient |
| R6n | Leading spaces and actual newline preserved in ordinary prompt; no expansion | Exactly `/ev20371` + newline + `report`; genuine native body/args and marker | Sufficient; freshly rebuilt |
| R6b | Ordinary `$ev20371`; no expansion | Exactly `/ev20371`; genuine native body without args and marker | Sufficient |
| R7n | Ordinary `$25 off`; no expansion | Byte-identical blocks; no expansion | Sufficient |
| R7p | Ordinary `$ev20371, report`; no expansion | Byte-identical blocks; no expansion | Sufficient |
| R8 | One native slash text block plus saved attachment path; expansion | Same slash/attachment ordering; native body and attachment suffix in args; marker | Sufficient |
| R9l | OpenCode ordinary `$ev20371 report`; four native records | Byte-identical outbound blocks; four native records; no Grok probe/expansion | Sufficient; gap repaired |
| R9m | OpenCode ordinary `report $ev20371`; four native records | Byte-identical outbound blocks; four native records; no Grok probe/expansion | Sufficient; gap repaired |

The native controls sometimes perform model-directed reads and return the fixture marker. This does not invalidate literal preservation, but marker-only claims would be false proof. Only R8 in baseline and R1/R6n/R6b/R8 in final have the injected native skill block. All 12 sessions per phase are distinct. Real Grok catalog paths and enabled/disabled flags match the synthetic project fixtures. The transparent wrapper forwards real CLI protocol traffic; R5 selectively faults inspect and delegates ACP normally.

## Repaired OpenCode history

Independently opened each isolated OpenCode SQLite database read-only, selected `message` and `part` rows by exact captured ACP session ID, and compared IDs, roles and text parts with the published JSON. Each session has one user and three assistant records; the final assistant has `finish:"stop"`, a completion timestamp, the original user's ID as parent, and an ACP message ID/text match. Both user text parts equal the two actual outbound ACP blocks exactly, including literal dollar text. No native injected skill block or Grok inspect occurs in these turns.

| Capture | Native session | User message | Final assistant |
|---|---|---|---|
| before R9l | `ses_e8fbf8090ffe9JiyNO7L3JaQAc` | `msg_170408645001SlXzKV6YxMMCl5` | `msg_17040c4c7001vdAcX7ufX7O1AU` |
| before R9m | `ses_e8fbf1681ffe0Tolugo1pwhP6g` | `msg_17040ef67001PUbTPSy3nast3B` | `msg_170412197001iG7waL94my2Thc` |
| after R9l | `ses_e8fbab637ffe1XR3eTwREqDNfY` | `msg_1704550190011ylnkiV00UhCPu` | `msg_170459ade001mNd86arFeX5dmQ` |
| after R9m | `ses_e8fba3fb8ffe1BwqWLjvuzWkgB` | `msg_17045c4eb001QpxuApyzsAwlRY` | `msg_17045fdae001OicaMmT1w7y1dv` |

[Independent 24-row assertions](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e245f11fb27a7f0d/row-audit.json) and [read-only verification script](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a0716e207191dc90/audit_rows.py). All published SHA256SUMS entries passed; evidence archive entries match the reviewed public files. Driver archive SHA-256: `3358590e218c7d1051d28d90305cac3973705a85693faa5a1d47302a7b3d6c7b`. Evidence archive SHA-256: `c23fbf0cef709bd1e77362bf35e4ef0730c549e50c5d7715b86b46cfaa29d6b6`.

## Fresh independent rebuild

Extracted the final local published driver archive, adapted scratch root and port to `/tmp/pr-20371-final-audit/run` and 18373, and rebuilt wrapper symlinks there. Used its seed, provider provisioning, server launch, normal settings/project RPC, normal `message.dispatch`, transparent tee and native collector. Fresh unseeded T3 home and fresh provider home; `T3CODE_DEV_SEED=0`, `--no-seed`. Credentials came from the injected environment and remained private. No live userdata was accessed.

Rebuilt R6n at exact final HEAD: submitted `  $ev20371\nreport` with an actual newline. Thread `d9bd158a-b7fe-4836-888e-6abd99066919`; native session `01a17048-f7a9-7581-9715-38930f57c66f`. Actual outbound is exactly `[{"type":"text","text":"/ev20371\nreport"}]`. Native first-user history contains the fresh project's skill path, actual skill body and `args="report"`; native assistant returns the exact marker, ACP returns `end_turn`, persisted run and provider turn are completed. [Fresh rebuild proof](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3a0ee65258a88cdd/rebuild-summary.json).

Stopped owned startup group 2119025, direct server group 2119556 and recorded provider child 2120265. Port 18373 has no listener; original evidence port 18371 is clear. Worktree remains clean. Scratch retained for cleanup: `/tmp/pr-20371-final-audit`; it contains private tokens/provider material and must not be uploaded wholesale. No repository edits, checkout changes, commits, comments, pushes, watches, browser use, or forge/CI polling.

## Tests and limits

Final logs substantiate 10 skills tests, six selected ACP tests, and three external regression cases passing. Baseline regression harness has one intended failure (expected bare `/deploy ship it`, received ordinary instruction-wrapped dollar text), with two controls passing. The final check:changed log reports format/lint/knip/graphql, seven-package typecheck and 72 tests passed. Logs were inspected, not independently rerun. The fresh runtime rebuild independently anchors final behavior; baseline runtime was not rebuilt by this repeat audit. No live forge metadata was queried, so no claim is made that the replacement is already the published PR head or that current CI/reviews are green.

This is server/provider prompt assembly only. Web/desktop/mobile render paths, UI entry points, contracts and visual appearance are unchanged. Native transcript recordings are appropriate proof; screenshots and rendered UI diffs are inapplicable. The hook applies only to the Grok flavor, and R9 guards the shared ACP path for OpenCode.

Evidence: [final matrix/index](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/372c35372f0794f3/pr-20371-final-proof-matrix.md), [final evidence archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/39eab8620149bcaf/pr-20371-final-evidence.tar.gz), [final driver archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3178f8dd49e7da9d/pr-20371-final-drivers.tar.gz), [final check:changed log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f6099763af5fd2e8/pr-20371-final-check.log).

FRICTION: Driver archive contains absolute wrapper symlinks; safe extraction rejected them. The first shell sequence continued before adaptation and reran identical synthetic fixture/config provisioning at the original scratch root, then launched owned group 2118631. It was stopped immediately before any RPC submission. Published evidence/archives and all manifest hashes remain unchanged. The successful independent rebuild used only the fresh audit root.

FRICTION: One initial RPC configure attempt preceded the direct server listener and failed; retry after confirmed listener succeeded. No submitted turn was duplicated.

FRICTION: Literal controls may manually read the fixture and return its marker. Native injected first-user skill content, not marker assertions, distinguishes actual command expansion.

Audited with GPT-6.1 Sol through the Codex harness in T3 Code. Published drivers and fresh rebuild proof provide reproduction trace without committing scratch.

VERDICT: SUFFICIENT