Proof audit, pass 1 — [#33587](https://git.cafe/pingdotgg/t3code/pull/33587)

Reviewed head [26174fb0a1](https://git.cafe/pingdotgg/t3code/commit/26174fb0a197be51e227b0071beed606aeafd2eb), branch `fix/issue-33552`, against merge-base [9110dc2c93](https://git.cafe/pingdotgg/t3code/commit/9110dc2c932cb3bc57dc2845b9f1ea362f248796). Read-only audit; no source edits, pushes, PR comments, browser use, servers or devices started.

Findings

1. **The existing runtime proof covers R02 only.** The before transcript reports server exit 980 ms after SIGTERM with daemon PID 1740369 still alive and `daemon.json` present. The after transcript reports exit in 1186 ms, the same daemon dead, and a directory listing with no `daemon.json`. This is useful real-server evidence for orphan cleanup with the current pin, not evidence for the alternate CLI selection, settings-toggle, invalid-state, dead-daemon, or this-process-started cases. Both elapsed-time transcripts are suitable for this timing claim; a screen recording would add no signal.
2. **The old after capture is applicable to the requested code, with a version-selection qualification.** All three changed files have identical Git blobs at captured [6c4b13cee2](https://git.cafe/pingdotgg/t3code/commit/6c4b13cee2) and reviewed head. The merge changes none of them. Also unchanged between those revisions: `deviceToolVersions.json`, `DeviceService.ts`, `processRunner.ts`, and `packages/shared/src/nodeRuntime.ts`. Thus R02 does not need an after recapture solely because main was merged. However, the transcript does not print the daemon's recorded version or the install sentinel; the driver supplies the intended current pin and installs it if the sentinel is absent. R02 is credited as current-pin orphan cleanup, not as independent proof that recorded-version preference was exercised.
3. **The before baseline is incompletely attested.** Its header is the feature commit plus two modified files. The driver prints modified paths, but neither restores main's files nor records their content hashes. The PR explains that those files came from [ad9e87111f](https://git.cafe/pingdotgg/t3code/commit/ad9e87111f); those two committed files equal the requested merge-base files (verified by empty diff). That makes the account consistent, but does not independently identify the dirty bytes actually executed. Accept the before transcript as a reported reproduction with this qualification; a strictly reproducible before capture should run a clean merge-base checkout or log both executed file hashes. This does not invalidate the clean after result.
4. **The two new tests prove a stop request and CLI selection, not process termination.** `vp test run apps/server/src/device/LocalDeviceHost.test.ts` at reviewed head passed: 1 file, 21 tests. The two new tests use a mocked runner and empty CLI files. They verify R02's requested `daemon stop --state-dir` and R03's selection of an installed old CLI. No `LocalDeviceHost.test.ts` test asserts stopAgent's daemon cleanup, fallback, missing install, invalid record, stale-dead record, or stop-time error containment. Startup tests that happen to run finalizers do not assert those shutdown outcomes.
5. **Desktop/macOS remains outside the supplied proof.** The PR explicitly says this was not checked. The issue describes a daemon under an Electron executable. A Linux Node server transcript proves this scoped server cleanup path, not native Quit or execution through Electron. A comment on the PR links experiments for [#33566](https://git.cafe/pingdotgg/t3code/pull/33566), explicitly on another candidate; those are not evidence for this head. Hub shutdown still precedes daemon shutdown; a stalled hub is a separate pre-existing limitation, not a newly established regression here.

Sources opened and read in full: [before transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d6b9565a3d5e14d3/issue-33552-before-main.txt), [after transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4840b006e5a01545/issue-33552-after-fix.txt), [driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3fbae846390af077/issue-33552-orphan-quit.sh). Each was downloaded into the auditor's scratch directory. PR description, issue, review comments, review records and current-head check status were also read through GitCafe. CI has no failures in the observed snapshot, but some checks remain pending; this is a proof audit, not a merge verdict.

Derivation and fixture data

The changed shutdown effect first checks for `daemon.json`; if present it tries to decode `{httpPort, token, pid?, version?}`. An unreadable, syntactically malformed or schema-invalid record becomes `None`; absent/empty version also omits the recorded candidate. It searches installed candidates in order: recorded nonempty version, then current pin. An install is eligible only when its CLI entry exists and its `.install-complete` contents, trimmed, equal that version. Missing, incomplete, mismatched-sentinel and unreadable installs all collapse to not installed. The first eligible CLI wins; no candidate means return without installing. If selected, Node is resolved and the real CLI receives `daemon stop --state-dir <T3-owned-state>`, with the update notifier disabled and a 10 s process timeout. Stop-time typed failures are ignored; nonzero/timed-out result objects are also not checked.

There are two direct callers: `stop` and `stopAgent`. `stop` clears `runningRef`, closes the hub, removes hub state, then runs daemon cleanup; it is both the scope shutdown finalizer and the device-disable operation. `stopAgent` runs daemon cleanup and clears only the cached agent endpoint. `DeviceService.configure` calls `stop` when the effective device-support setting is false, otherwise `stopAgent` when input `agentAccessEnabled` is false. No CLI version-selection cross-product needs repeating at both callers because they execute the same effect; representative caller-specific captures still need to show different hub/server/cache outcomes.

Common fixture: a new timestamped run directory under lead scratch; isolated `--base-dir B`; daemon state `S=B/userdata/device/agent-device`; exact server/head and CLI versions; original daemon PID, start identity and health; CLI entry and sentinel availability; settings before the action. Never point a driver at live T3 data. Use the linked driver as a recipe only: its documented usage omits the required exported `OUT`, it uses a fixed port and shared worktree `.t3`, and it lacks a cleanup trap. A revised driver must export a per-run `OUT`, choose an unused port, bound startup/shutdown waits and track every spawned PID for cleanup. Do not execute the downloaded driver unchanged.

For every runtime capture: show the action and timestamp/elapsed time, result/exit status, original PID alive/dead with identity verification, `daemon.json` present/absent, and selected CLI execution where selection matters. For SIGTERM, show server exit latency. For RPC, show `device.configure` input, response or error and elapsed time while the server remains alive; also show hub survival/exit as relevant. Redact daemon tokens, auth credentials, pairing URLs and private runtime identifiers. These are transcripts, not recordings: every timing distinction here is measurable in timestamps.

| Row / fixture | Required data and trigger | Expected observable outcome / branch covered | Diff affected? | Minimum proof and real-server route | Existing evidence / status |
|---|---|---|---|---|---|
| R01 — no daemon record | No `S/daemon.json`; run both shutdown and agent-off on fresh isolated state. Include a variant that previously readied agent tools but whose record disappeared. | No daemon-stop subprocess and no installation. Shutdown exits; agent-off leaves server/hub usable. Previously cached tool state must not bypass the new file guard. | Yes: new file guard; ordinary never-started outcome preserved. | Transcript with file absence and a targeted execution observation proving no daemon CLI/npm ran. SIGTERM for stop; `device.configure({enabled:true, agentAccessEnabled:false})` for stopAgent. Both are drivable. No existing named shutdown test covers this outcome. | **MISSING runtime**. Startup tests alone do not assert the no-spawn claim. |
| R02 — live orphan, current pin installed | Linked driver's pre-existing live daemon; no `ensureAgentReady` in the server session; current pin eligible; SIGTERM. | Server exits; original daemon dies; record removed. Daemon need not have been started by this server. | Yes: fixes null process-local tool reference. | Existing before/after elapsed-time transcripts suffice for the scoped runtime outcome; metadata caveats above. Test: `stops a daemon recorded by a previous server when the host stops`. | **COVERED, carried forward** from identical after code. Before provenance and exact recorded-version metadata qualified. |
| R03 — live orphan, older recorded CLI installed | Real older daemon version V with V's CLI entry and matching sentinel installed alongside the current pin. Record explicitly says V. SIGTERM without reading agent tools. | Old CLI selected ahead of current; original daemon dies and record removed. | Yes: ordered recorded-version preference. | Driver variant installs and starts a real supported older V, leaves both installs, logs selected CLI execution and shutdown outcome. Real server can reach it. Test: `stops a previous server's daemon with the agent-device version it recorded` proves path selection only. | **PARTIAL: unit selection passed; runtime MISSING**. Synthetic `0.0.1` empty CLI is not a real-version stop. |
| R04 — current-pin fallback | Live daemon with recorded V's install unavailable/ineligible, current pin eligible. Also a valid record with version absent/empty. | Current CLI selected; no install attempted. Capture whether it actually retires the real daemon and removes its record; cross-version success cannot be inferred from argument selection. | Yes: fallback search. | Driver variant starts V first, then makes only its isolated install ineligible (e.g. move sentinel), leaving current eligible. Separate no-version variant uses a valid record without version. Log selected CLI and post-state. Both are drivable. No matching named test in `LocalDeviceHost.test.ts`. | **MISSING runtime and focused fallback assertion**. |
| R05 — no eligible CLI | Present valid live record; recorded and current installs missing/incomplete or sentinel mismatch. No tools readied in server. | Graceful return with no stop subprocess and no npm install; daemon stays alive, record stays. This is current best-effort behavior, not successful cleanup. | Yes: new on-disk eligibility decision. | Driver variant starts real daemon before making both isolated installs ineligible. SIGTERM and observe bounded exit plus live PID/retained record; restore fixture and explicitly stop captured PID afterward. Real server can reach it. No matching named shutdown test. | **MISSING runtime**. |
| R06 — record cannot be decoded/read | Present malformed JSON, schema-invalid JSON or unreadable file; current pin eligible. Preserve any actual daemon PID outside the damaged record for observation. | T3 falls back to current CLI and ignores stop failure. Whether the CLI can retire a daemon from damaged/unreadable state is CLI-defined; do not claim removal without capture. Server must still finish its action. | Yes: `readDaemonFile().option` fallback. | Driver variants corrupt only isolated state or remove read permission under a non-root fixture owner. Show CLI attempt, elapsed exit/action result and actual PID/file outcomes. Unreadable and malformed variants each need observation because the CLI may treat them differently. Real-server drivable; no matching named shutdown test. | **MISSING runtime**; cleanup outcome unproven. |
| R07 — daemon dead, stale valid record | Real previously captured daemon is already dead, valid stale record remains, one eligible CLI. | Stop command is attempted without T3 health/PID liveness gating; no new daemon should appear. Observe stale-file cleanup rather than assuming it. Shutdown completes. | Yes: a never-readied server now attempts this cleanup. | Start a fixture daemon, capture registration, terminate only its captured PID, retain/restore the registration, then start and SIGTERM a server that never readies agent tools. Record all final state. Real-server drivable; no matching named shutdown test. | **MISSING runtime**. Health-restart startup test is a different behavior. |
| R08 — this server starts daemon, then quits | Fresh record absent; device support and agent access enabled through `device.configure`, causing this server to ready tools; daemon live, current install intact. | SIGTERM stops hub and daemon, clears registration, and exits within observed budget. Preserve the existing working path after removing cached `agentToolRef`. | Yes: path still required but CLI/Node now resolved from disk at stop. | Actual RPC enable/readiness, then SIGTERM. Show hub/daemon identities, record and exit latency. Real-server drivable. Existing startup tests exercise mocked finalizers without asserting this termination. | **MISSING runtime**. Linked orphan driver intentionally never starts the daemon through this server. |
| R09 — live orphan, agent access off | Pre-existing live orphan and eligible current CLI; device support enabled but this server has never called agent readiness. | `stopAgent` stops orphan, leaves hub/server alive, clears agent endpoint; setting is false afterward. | Yes: other changed direct caller. | Set initial isolated settings to device support on without enabling agent readiness; send `device.configure({agentAccessEnabled:false})` (or `{enabled:true,agentAccessEnabled:false}`). Server-scoped Settings → Integrations → Agent device access off reaches this RPC. Capture input/response, elapsed time, daemon/file state and server/hub liveness. No browser is needed. No matching `LocalDeviceHost.test.ts` case. | **MISSING runtime**. DeviceService test `installs agent support only after the separate agent permission` verifies dispatch with a fake host, not local daemon termination. |
| R10 — this server starts daemon, agent access off | Ready hub and daemon via real RPC as in R08, then disable only agent access. | Daemon and registration removed, hub/server remain usable, agent access false. Cached agent endpoint must be cleared. | Yes: same caller now uses record lookup instead of cached tool. | `device.configure({agentAccessEnabled:false})` with device support still on; capture response, state and health as in R09. Real-server drivable. No matching local stopAgent assertion. | **MISSING runtime**. |
| R11 — device support off invokes stop | Ready hub plus daemon, then device-support disable rather than SIGTERM. | Both helpers stop, settings/device state become disabled; server stays alive and RPC completes. Shows the non-finalizer caller of `host.stop`. | Yes: DeviceService reaches the changed stop effect. | `device.configure({enabled:false,agentAccessEnabled:false})`, also reached by server-scoped Device hub switch off. Capture response, elapsed action time, helper PIDs, record and server liveness. Real-server drivable. No matching local shutdown assertion. | **MISSING runtime**. Same CLI lookup needs no repeated version matrix here. |
| R12 — best-effort errors and timeout | File-existence check fails; or eligible CLI but Node resolution fails; or runner fails/returns nonzero/timedOut. | Effect returns despite typed failure or failed result; shutdown/agent-off proceeds, with daemon/file possibly retained. Stop timeout configured to 10 s; no unconditional daemon-dead claim. | Partly: new existence/resolution boundary; runner timeout/error swallowing preserved. | Deterministic filesystem/Node/runner fault injection is better unit proof than flaky environmental capture. Ordinary permissions and nonzero real CLI cases are also runtime-reachable. No named stop-time test exists in `LocalDeviceHost.test.ts`; the startup execution-failure test is not this case. Add a focused local stop-time case only if fault-containment proof is required; use controlled completion/TestClock, not sleeps. | **UNIT COVERAGE LIMIT**. No existing stop-time assertion; supplemental fault injection, not part of the minimum real-daemon capture set. |

Minimum additional capture set at reviewed head

**Exactly R01, R03, R04, R05, R06, R07, R08, R09, R10 and R11 need new runtime observations to close this complete branch/caller matrix.** They can be sections of one timestamped transcript; one upload per row is unnecessary. Include R04's unavailable-recorded-install and missing-version variants; R06's malformed/schema-invalid and unreadable variants; R01's no-record checks for both callers. Reuse common setup and avoid a full Cartesian product: version branches R03–R07 do not need repeating through every RPC caller. R02's existing after capture is acceptable by verified code equivalence; a fresh R02 capture is optional rather than required by the merge. If strict independent before provenance is required, add a clean merge-base R02 before run with file hashes. R12 records the uncovered error-containment boundary; deterministic unit proof is preferable if that supplemental assurance is requested, and no new real-daemon transcript is mandatory for it. No row needs a recording instead of a timestamped transcript.

No new runtime captures were made in this proof-audit pass. The native Electron/macOS path is a separately disclosed verification limit, not silently counted as covered by these Linux fixtures. The requested server-only proof does not require frontend screenshots, provider turns, or simulator leases.

Verification and cleanup

- Full changed diff and relevant helper, caller, contract and settings paths inspected.
- Merge-base and three unchanged file blobs verified; baseline file equivalence checked.
- Focused suite: 21 passed, no failures; test log uploaded separately with this report.
- Worktree was clean before and after diagnostics. No owned server/emulator/lease exists to stop. Only auditor scratch is removed after uploads; lead scratch and lead worktree remain untouched. Disk availability was 9 GiB initially and 7 GiB at final verification, above the 5 GiB stop threshold.

FRICTION: none

VERDICT: INSUFFICIENT R01,R03,R04,R05,R06,R07,R08,R09,R10,R11 runtime captures