# Independent evidence capture — terminal legacy history collision

Captured 2026-10-24 for [#18671](https://github.com/pingdotgg/t3code/pull/18671) / [#18671](https://git.cafe/pingdotgg/t3code/pulls/18671). This is evidence capture, not a proof audit or merge recommendation.

Before: [909e4c9482](https://github.com/pingdotgg/t3code/commit/909e4c948278afc2b3e1e665075fb1755a13f894). After: [dc98776633](https://github.com/pingdotgg/t3code/commit/dc98776633a556a05aad14550c89d235d5a0e1e1), `takeover/pr-18671`. Original contribution head: [9f70943e77](https://github.com/pingdotgg/t3code/commit/9f70943e771071135c6a7f7caf708a548b3b449b). Only checkout used: `/home/ubuntu/wt/pr-18671`; HEAD stayed at replacement and final git status is clean.

## Coverage and observations

All 21/21 numbered scenarios in the supplied matrix were independently rerun on both exact revisions: R1–R3, M1–M3, S1–S3, H1–H3, L1–L3, C1–C3, P1–P3. C6 was additionally expanded into 9/9 runtime cases per revision: 120-character encoded ID, 300-character ID, and nested subagent ID, each with read/default delete/thread delete, including 128-character named terminal ID. T1 operation ordering is captured by sequential service completion and persisted files in every scenario. Thus 30 service scenarios per revision, 60 total, plus R1–R3 over real server RPC on both revisions (6 integration scenarios).

| Real RPC row | Before actor history | Before owner history | After actor history | After owner history |
|---|---|---|---|---|
| R1 open/migrate | `owner-a\n` | empty | empty | `owner-a\n` |
| R2 individual delete | empty | empty | empty | `owner-a\n` |
| R3 thread delete | empty | empty | empty | `owner-a\n` |

Each row independently starts with exactly `terminal_YQ.log = owner-a\n`. R1 opens colliding `terminal_YQ`, closes it, then opens owner `a` and actor again. R2 calls `terminal.close` for `terminal_YQ`, `term-1`, `deleteHistory:true` before either thread opens; R3 omits terminalId to exercise whole-thread deletion. RPC responses record each loaded snapshot. Before R1 moves the seed into `terminal_dGVybWluYWxfWVE.log`; before R2/R3 leave an empty file map. After retains `terminal_YQ.log` byte-for-byte in all three cases. `PASS` before means the harness observed the expected defect, not that baseline is correct.

The original public driver and both original public JSONL transcripts were downloaded and inspected. Independent 21-row JSON objects match their respective auditor transcripts exactly; fresh homes and execution headers differ. Controls establish ordinary legacy migration/deletion, own-current precedence, named current retention/deletion, reserved-ID own-current access, hashed collisions, and unrelated owner preservation. C6 confirms persisted default/named payloads load and intended files delete under both encoded and hashed naming.

## Runtime and method

Linux x64, kernel Linux 6.1.102, Node v26.12.1, machine marker `fs-06`. Production dependencies are the existing installed checkout dependencies (including undici 8.11.2). Exact Manager source is obtained with `git show <full SHA>:apps/server/src/terminal/Manager.ts` and overlaid read-only in memory with Node registerHooks/stripTypeScriptTypes. The complete before-to-after diff changes only Manager.ts (4 additions/2 deletions) and Manager.test.ts (22 additions); all other production dependencies are identical. This runs the exact selected production Manager, rather than a separately rebuilt checkout of every file.

Service captures use real Node filesystem and production Manager public makeWithOptions/open/close, with inert PTY. RPC captures use the actual CLI serve command, fresh database migrations, actual ws.ts dispatcher, authorization, JSON Effect RPC over HTTP/WebSocket, and actual node-pty spawning `/bin/sh`. No UI/browser or provider turn was started. Each RPC case gets a new server process, HOME under its scratch home, fresh synthetic seed, random ephemeral dev credential, and localhost port. No inherited HOME credentials/config are passed. RPC calls specify empty PS1, ENV=/dev/null, HISTFILE=/dev/null. Full request steps, responses, PIDs, exact arguments and selected environment are in JSONL.

The capture dispatcher takes `--home-dir /tmp/ev-18671-…` and translates it to production CLI `--base-dir`; `--home-dir` belongs to dev-runner, not this production CLI. Direct server startup bypasses dev-runner and therefore performs no automatic database copy; T3CODE_DEV_SEED=0 is also explicitly set. Every database is newly migrated from empty state and every seed is synthetic. No reading, copying or writing of live userdata occurred. No worktree file was edited; scripts, snapshots, databases, and evidence are outside the worktree under `/tmp`.

All six successful RPC server processes were stopped in finally blocks by captured spawn PID, with exit observed (code 130 from CLI shutdown). Three preliminary RPC attempts also stopped their captured servers. Verification checks all 9 server PIDs plus all 15 returned PTY PIDs absent from /proc. No process was killed by a name/path pattern. No servers remain from this capture.

## Downloadable evidence
[matrix-driver-pinned.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/79b08342f52ff3e3/matrix-driver-pinned.mjs)
[c6-driver.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/845cf77998560c38/c6-driver.mjs)
[server-launcher.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/15829e0634ba4542/server-launcher.mjs)
[rpc-driver.mjs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/523319f2d53448f0/rpc-driver.mjs)
[matrix-before.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/816f9a2795546b3f/matrix-before.jsonl)
[matrix-after.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f117113dd37cee3d/matrix-after.jsonl)
[c6-before.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ae7f9ccecba8ae57/c6-before.jsonl)
[c6-after.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/7d177100ccceb23c/c6-after.jsonl)
[rpc-before.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a74985a7ea7ec753/rpc-before.jsonl)
[rpc-after.jsonl](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/1bfdd8a8627205ba/rpc-after.jsonl)
[verification.json](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9cf23d35aef6894b/verification.json)
[complete.diff](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9f2cbd09b5ddc10c/complete.diff)

## Fresh proof pass 2 recipe

Download the four linked .mjs files into `/tmp/ev-18671/` using their exact filenames. Inspect them before executing. Run from the same unchanged checkout with installed dependencies. These homes must not already exist; replace the suffix for each subsequent independent run.

```sh
node /tmp/ev-18671/matrix-driver-pinned.mjs --repo /home/ubuntu/wt/pr-18671 --phase before --home-dir /tmp/ev-18671-proof2-matrix-before
node /tmp/ev-18671/matrix-driver-pinned.mjs --repo /home/ubuntu/wt/pr-18671 --phase after --home-dir /tmp/ev-18671-proof2-matrix-after
node /tmp/ev-18671/c6-driver.mjs --repo /home/ubuntu/wt/pr-18671 --phase before --row C6 --home-dir /tmp/ev-18671-proof2-c6-before
node /tmp/ev-18671/c6-driver.mjs --repo /home/ubuntu/wt/pr-18671 --phase after --row C6 --home-dir /tmp/ev-18671-proof2-c6-after
node /tmp/ev-18671/rpc-driver.mjs before --home-dir /tmp/ev-18671-proof2-rpc-before
node /tmp/ev-18671/rpc-driver.mjs after --home-dir /tmp/ev-18671-proof2-rpc-after
```

For a smallest independent rebuild, add `--row R1` or `--row R2` to both matrix driver commands. The RPC driver captures all three direct defect rows and owns/stops its child servers. It never reuses these evidence databases. Server logs are written under `/tmp/ev-18671`; use a separate artifact directory if preserving old copies. The published RPC script includes an added output-only QR-line redaction after execution; RPC actions and assertions are unchanged. Tokens and token-bearing QR blocks are omitted from published logs. No databases, auth stores, environment files, or credentials are uploaded.

## What else changed and unverified

The production diff is limited to the legacy filename guard and two new regression cases, as in the downloadable complete diff. During this capture, no code edits, commits, pushes, PR edits/comments, or other forge writes occurred. App-owned PR registration was performed as required by this environment; no PR watch was started. This capture did not rerun the test suite, review CI, or certify mergeability; it independently captured runtime evidence. Public audit test outputs remain the auditor's evidence rather than a fresh test claim here.

Mixed-case M rows use an exact mixed-case surrogate and separate lowercase owner file on Linux. Native case-insensitive macOS/Windows behavior is unverified. UI, desktop/mobile clients, remote/relay/tunnel, browser flows, provider agents and performance under load were not exercised. All use the same server Manager; this capture establishes service and local server RPC behavior only. This is a runtime module overlay rather than a full clean rebuild of each revision; dependency equivalence follows from the complete two-file diff. Independent proof pass 2 remains a separate task.

## FRICTION

| category | issue | remedy |
|---|---|---|
| baseline reproducibility | Public driver recomputed merge-base from mutable origin/main | Pinned exact requested baseline SHA; kept source overlays read-only |
| RPC client dependency | `ws` package absent; first attempt exited before spawning server | Used installed undici 8.11.2 WebSocket; no install or worktree edits |
| RPC protocol | First upgrade omitted mandatory orchestrationProtocol=2 | Included protocol query parameter |
| startup readiness | HTTP listener initially responds 503 before RPC routes are ready | Bounded readiness check waits for non-503, then real authenticated upgrade; preliminary child processes stopped in finally |
| CLI naming | Production CLI supports --base-dir; --home-dir is dev-runner's flag | Capture driver explicitly maps --home-dir to --base-dir and sets T3CODE_DEV_SEED=0 |
| public credential redaction | Server startup prints ephemeral credential in text and QR | Replaced credential text and removed QR block lines before upload |
| platform coverage | Linux does not naturally alias mixed-case history names | Reused disclosed surrogate; native case-insensitive verification remains unperformed |
[rpc-before-R1-server.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/216180a66bf79089/rpc-before-R1-server.log)
[rpc-before-R2-server.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/731cb70ddb0dc95c/rpc-before-R2-server.log)
[rpc-before-R3-server.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d2b4c6648d5d37c9/rpc-before-R3-server.log)
[rpc-after-R1-server.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b0343f7f5500fa9d/rpc-after-R1-server.log)
[rpc-after-R2-server.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c918ec37a5961873/rpc-after-R2-server.log)
[rpc-after-R3-server.log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/aa454f5ae8c05ddc/rpc-after-R3-server.log)
[SHA256SUMS](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bc7af358554c75b9/SHA256SUMS)