# Proof audit, pass 1 — [#32913](https://git.cafe/pingdotgg/t3code/pull/32913)

**INSUFFICIENT as written.** The linked Linux evidence is substantial and internally consistent. This verdict identifies a missing cancellation path and exact claims the supplied captures do not establish; it does not reassert the obsolete audit's missing-all-proof finding.

1. **S31: missing foreground-shell cancellation proof.** The PR adds backoff to both `fetch` and the interactive `download` loop. Every shell Ctrl-C action in the 254-pair inventory is on the latter (S24/S25, path D). A `fetch` backoff is synchronous and has different trap context: discovery runs before staging traps are installed; checksum fetch runs after INT/EXIT traps. Capture Ctrl-C during these foreground waits under dash and bash --posix. The D captures cannot establish that separate changed path.
2. **E05: the “what else changed” account misstates unresolved302.** It says curl exits nonzero for both unresolved302 and local write errors. For302, `curl -sSL` exits0; `fetch` rejects its HTTP status and retries. The supplied S22 traces show the changed behavior and the interactive302 success path; the exact-argv local diagnostic independently recorded curl exit0, HTTP302, empty stderr. Correct the explanation; no implementation change is implied.
3. **E01/E02/E03/E04/E06/R01: exact claim gaps.** Three L14 pairs intentionally inject synthetic fetch shapes, contradicting “Each fixture ... against a local release server.” No shell/PowerShell502, Node20.11 launcher, baseline interrupted launcher, non504 native-wget retry-policy control, or original historical real-GitHub outcome transcript is linked. These are claim-level gaps: narrow/remove the claims or provide the original evidence. In particular, 503/507 already establish the shared5xx classifier; a new502 test is unnecessary if the PR stops claiming that exact capture.
4. **The linked matrix is an obsolete audit, not the current coverage result.** It names an older head, says there are no uploaded captures, and reports the launcher's old enumerated5xx defect. The current index explicitly supersedes those findings; current source and L04 cover501/505/507/524/599. Replace or clearly label the stale matrix link to avoid presenting contradictory audit conclusions.

Reviewed read-only in `/home/user/wt/pr-32913` at [1af59792b3](https://git.cafe/pingdotgg/t3code/commit/1af59792b3ca105da634cdf90c392bae9ad1ff91), against local `origin/main` [f12bb6229c](https://git.cafe/pingdotgg/t3code/commit/f12bb6229c007a12d24fd2e539222733778ac9ea). The worktree stayed clean. No edits, pushes, comments, reviews, or ref updates were made.

Before is [bcee0f5d28](https://git.cafe/pingdotgg/t3code/commit/bcee0f5d2872ba193c66ed9ba979bbe424f89ff9), independently confirmed as the merge-base of evidence head [965b08b306](https://git.cafe/pingdotgg/t3code/commit/965b08b3060575186415df240c898a50c8736c5d) and current `origin/main`. After is [965b08b306](https://git.cafe/pingdotgg/t3code/commit/965b08b3060575186415df240c898a50c8736c5d). Its `scripts/` tree is byte-identical at requested head [1af59792b3](https://git.cafe/pingdotgg/t3code/commit/1af59792b3ca105da634cdf90c392bae9ad1ff91) (tree93f8958c89a3ecb26c3549a466957c42f9eaa224). The only first-parent commits after the evidence head are the two main merges. GitCafe and the remote branch still reported the preceding merge [ecb0db2bfb](https://git.cafe/pingdotgg/t3code/commit/ecb0db2bfbc26a3edb2dadd9e40afbc6aff5c342); I reviewed the explicitly requested local pin.

The full five-file diff and all three scripts/callers were read. No UI changes exist, so screenshots and client-browser testing do not apply. No new product test suite was run: this pass audits existing raw proof.

The audit opened both current and original index, the linked matrix, all five transcript archives, drivers, normalizer and verification records. It parsed all508 primary transcripts from254 pairs, independently matched500 executed runtime scripts to pinned source and declared exact-slice/origin transformations, matched six exact synthetic `get` helpers and16 regression-source manifest entries, regenerated508 normalized views and254 raw/normalized pair diffs, and verified three selected head/head normalized diffs are empty. No pin/hash/transformation/output/diff mismatch or primary timeout was found. The corrected P11 W/R and P14 R/W/H pairs are present in the current bundles and were checked directly, not inferred from obsolete variants. The PS mixed captures really exhaust four native drops before outer waits1s and2s.

## Matrix derivation and minimum set

The independently traced control flow is: shell F `fetch` success / special404 / ordinary4xx / all remaining statuses and curl errors / attempt4; shell D reaping, status-sidecar gate, restart, success/failure/cleanup; PowerShell shared R/W catch-and-rethrow loop plus separate H GetAsync catch/status/disposal loop and post-header reads; launcher shared `get` fetch/cancel/catch loop with special404, generic failure, fourth-attempt and post-header boundaries. Callers are stable and paginated discovery, checksums and archives (shell/PS), and checksums and archives (launcher).

F = shell foreground `fetch` (sums represents common classification; archive F is separately wired); D = shell interactive archive; R = PowerShell Invoke-RestMethod; W = Invoke-WebRequest; H = interactive HttpClient. Shell changed retry/process fixtures use dash and bash --posix; PS proof is real PowerShell7.4.6/Linux helpers/caller slices, not a complete Windows install; launcher proof is actual Node26.12.1 launcher plus explicitly labeled synthetic L14 branches.

D = directly affected; C = caller/integration; U = unchanged control. M = minimum changed-path fixture; K = necessary only to retain an exact PR proof claim; O = optional unchanged/context control. Do not multiply every status by every caller:408 and429 are separate branches,403 represents ordinary4xx,404 needs special callers,504 covers common5xx and507 guards against a fixed status allowlist. Error exhaustion, fourth success and mixed budget are distinct fixtures. Extra501/505/524/599 runs are existing useful coverage, not a demand for every possible5xx. S31 adds the independently identified missing foreground cancellation branch to the old73-row inventory. E rows audit precise prose claims rather than inventing new implementation branches.

Windows PowerShell5.1 and macOS /bin/sh are **cannot-verify windows / cannot-verify macos**, as requested. They do not count as missing or contradicted rows.

| Row | Named fixture | Diff effect | Minimum capture | Status | Raw observations / coverage limit |
|---|---|---|---|---|---|
| S01 | Stable latest lookup 504→200 | D+C | M: F, stable lookup | covered | Both shells; same URL twice, Accept JSON, ~1.02s; cached version resolves. |
| S02 | Nightly/preview page-2 retry | D+C | M: F, both trains | covered | Both shells; page 1 once, page 2 504→200; version resolves. |
| S03 | Recovered lookup lacks matching tag | C | M: F, latest | covered | 504→200 then existing could-not-find error; no assets. |
| S04 | Recovered API empty/page-10 cap | C | M: F, empty and cap | covered | Retry stays on page 2; empty ends or requests stop at page 10. |
| S05 | Checksum retry and full install | D+C | M: checksum F | covered | 504→200, healthy archive, marker and executable/symlink verified. |
| S06 | Noninteractive archive retry | D+C | M: archive F | covered | Both shells, redirected output; archive 504→200, installed. |
| S07 | Interactive archive retry, known length | D+C | M: archive D | covered | Both shells, stdin piped/stderr PTY; new curl PID, 100%, no sidecars/staging. |
| S08 | Chunked body and redirect after retry | D+C | M: D, no length and redirect | covered | Both shells; 504 then chunked success, with/without 302; valid install. |
| S09 | HTTP 408 recovery | D | M: F+D | covered | Both shells and paths; one retry then success. |
| S10 | HTTP 429 recovery | D | M: F+D | covered | Both shells and paths; one retry then success. |
| S11 | Representative 5xx: 507 and 503 | D | M: F+D, 507 representative | covered | Both shells/paths; 503 and 507 recover. The distinct PR claim for 502 is E02. |
| S12 | Permanent ordinary 4xx (403) | D | M: F+D | covered | One target request only; F exit 1, D curl exit 22; no sentinel 200. |
| S13 | Checksum 404 special caller | C | M: checksum F | covered | One request, old-release/no-archive error retained. |
| S14 | 404 at latest/API/archive | C | M: both discovery callers, archive F+D | covered | Both shells; one target request, original caller-specific exits/diagnostics. |
| S15 | Four 504s exhaust retry budget | D | M: F+D | covered | Four target requests; gaps ~1/2/4s; same final failure; no fifth request. |
| S16 | Success on attempt four | D | M: F+D | covered | Three 504s then accepted 200 after all three waits; installed. |
| S17 | Preheader disconnect recovers | D | M: F+D | covered | DROP_PREHEADER→200; curl failure then one wait; installed. |
| S18 | Persistent connection refusal | D | M: F+D | covered | Four curl execs; ~1/2/4s; D uses redirect to reserved non-listening port. |
| S19 | Truncated 200 checksum/archive | D | M: sums F, archive F+D | covered | curl 18; retried full request overwrites partial output and installs. |
| S20 | Ignore Retry-After 120/date | D | M: F+D, 429+503, date representative | covered | All variants retry ~1s rather than waiting for Retry-After. |
| S21 | Mixed failures/permanent status after retry | D+C | M: F+D | covered | Drop→504→200 uses shared 1/2s budget; 504→403/404 stops at second response. |
| S22 | Unresolved 302 | D+U | M: F+D | covered | F repeats four times then GET302; D makes one archive request then checksum mismatch. Curl-exit claim is E05. |
| S23 | Local curl output failure | D | M: F+D helper destinations | covered | F and writable-sidecar D retry curl23 four times. Missing parent prevents D sidecar/curl launch and fails immediately; explicitly disclosed. |
| S24 | Ctrl-C during restarted active archive | D+C | M: D, both shells | covered | Terminal Ctrl-C, exit130, peer closes, captured curl gone, no staging/marker. |
| S25 | Ctrl-C during interactive download backoff | D+C | M: D, both shells | covered | After second504, interrupt during 2s wait; exit130, no respawn/staging/downloader. |
| S26 | GNU wget foreground native504/404 | U | K: wget-only F | covered | One wget invocation internally recovers504; checksum404 retains mapping. Other native statuses are E06. |
| S27 | GNU wget interactive loop | D+U | M: wget-only D, both shells | covered | Healthy and native504 recovery install;403 exits8; changed loop works without .status. |
| S28 | Completed exact-version shell cache | U | O: F control | covered | Zero HTTP, successful existing-version/link behavior. |
| S29 | Old curl long Retry-After | D | M: dash, curl7.68+7.74, F+D | covered | Actual version metadata;429/503 with120 retry ~1s and install. |
| S30 | BusyBox fallback; macOS shell | C+U | M: BusyBox F+D; platform compatibility | covered / cannot-verify macos | BusyBox healthy/403/404/504 on F/D; no native504 retry. No macOS execution; excluded from missing rows. |
| S31 | Ctrl-C during foreground fetch backoff | D+C | M: F checksum and discovery, both shells | missing | All shell interrupt actions are S24/S25 with path D. No foreground-fetch wait interruption; checksum has staging INT/EXIT traps, discovery precedes them. |
| P01 | IRM stable discovery retry | D+C | M: R latest | covered | Actual discovery slice;504→200, parsed object and resolved1.2.3. |
| P02 | IRM nightly/preview page2 | D+C | M: R both trains | covered | Actual caller; page2 retried, page1 not replayed, draft filtering/version preserved. |
| P03 | IWR checksum dispatch | D+C | M: W without progress, pipe+PTY | covered | Both runs select real IWR;504→200, correct bytes/hash. |
| P04 | IWR redirected archive | D+C | M: W archive -progress, redirected | covered | terminal=False/interactive=False; real IWR repeats archive then succeeds. |
| P05 | Terminal glyph fallback to IWR | C | M: W -progress, ASCII terminal | covered | terminal=True/interactive=False/ASCII; real IWR recovers504; exact dispatch used. |
| P06 | Interactive HttpClient known length | D+C | M: H PTY | covered | 504→slow200; failed response and final resources disposed; complete bytes/hash. |
| P07 | HttpClient chunked success | C | M: H no-length | covered | 503→chunked200; complete output and final disposal. |
| P08 | HTTP408 | D | M: R+W+H | covered | Each mechanism retries once, then succeeds. |
| P09 | HTTP429 | D | M: R+W+H | covered | Each mechanism retries once, then succeeds. |
| P10 | Representative other5xx 507 | D | M: R+W+H | covered | Each mechanism recovers507; common503 covered by P07/P18. No502: E02. |
| P11 | 403/404 permanent status | D+C | M: R+W+H; lookup/archive404 | covered | Corrected R404 targets actual latest lookup; corrected W404 targets archive. One target call, no sleeps, original error. |
| P12 | Checksum404 original status mapping | C | M: W actual checksum caller | covered | One request; .value__ drives original win32 no-release-archive error. |
| P13 | Four504 exhaustion | D | M: R+W+H | covered | Four outer calls, completed1/2/4s sleeps, final original error; H disposal traced. |
| P14 | Fourth success and mixed network/HTTP budget | D | M: R+W+H, both sequences | covered | Corrected four-drop sequences exhaust native retry, then outer1s,504,outer2s,200; fourth504-sequence success also captured. |
| P15 | Preheader network recovery/refusal | D | M: R+W+H | covered | Single drop is native recovery on BOTH pins; four drops exercise outer catch. Refusal shows four outer calls/three sleeps and final error. |
| P16 | IRM/IWR truncated200 body | D | M: R, W checksum+archive | covered | Body-read exceptions trigger one outer retry and correct complete result. |
| P17 | HttpClient post-header truncation boundary | U | K: H archive | covered | One archive200 then Read exception; no retry; final disposals. Current PR explicitly discloses limit. |
| P18 | Retry-After120/date ignored | D | M: R+W+H,429+503/date | covered | Each mechanism uses ~1s outer sleep; no120s stall. |
| P19 | Retry ends403/404 | D+C | M: R+W+H, checksum caller | covered | 504 then403/404 stops on second request; dedicated checksum504→404 preserves special mapping. |
| P20 | Successful HTTP with invalid content | C+U | O: R lookup/API, W checksum caller | covered | Missing tag, empty/capped API, missing checksum/digest all fail through existing caller behavior, without content retries. |
| P21 | Local output errors in W/H | D+U | K: W invalid destination; H invalid file | covered | W retries status0 DirectoryNotFound four times; H file creation fails after one request outside loop. |
| P22 | Ctrl-C during backoff | D+C | M: R+W+H PTY | covered | Each interrupted after two504s during second wait; no later request/success; PS7 Linux exits0, recorded accurately. |
| P23 | Ctrl-C during restarted H body | D+C | M: H PTY | covered | Interrupted held stream, peer EOF/resources disposed, no success; PS7 Linux exit0. Helper-only proof. |
| P24 | Windows PowerShell5.1/full install | C | Platform compatibility | cannot-verify windows | No Windows runtime/full-install capture; explicitly excluded from missing rows as instructed. |
| L01 | Launcher checksum504 | D+C | M: sums get/full install | covered | 504→200,~0.5s; body canceled; archive/marker/executable succeeds. |
| L02 | Launcher archive504 | D+C | M: archive get, pipe+PTY | covered | Only archive repeats; PTY progress, final hash/install succeeds. |
| L03 | 408/429/500/502/503 | D | M: sums representative get | covered | Each separately captured; one cancellation/retry then success. |
| L04 | Full5xx classifier 501/505/507/524/599 | D | M: 507 representative;524 regression | covered | All five retry and install. Old matrix contradiction is stale and superseded. |
| L05 | 403/404 at sums/archive | C+U | M: both request paths | covered | One target call; generic403 and version-aware404 errors unchanged. |
| L06 | Four504s exhaust budget | D | M: sums get | covered | Four requests,~0.5/1/2s, three body cancellations, final GET504; no fifth. |
| L07 | Fourth request succeeds | D | M: sums get | covered | Three504s then200; accepted body and successful full install. |
| L08 | Preheader disconnect at both callers | D | M: sums+archive | covered | Real fetch rejects once;~0.5s then clean successful install. |
| L09 | Persistent fetch rejection | D | M: sums get | covered | Four fetch_start/rejected events,~0.5/1/2s; original fetch error, no stale HTTP diagnostic. |
| L10 | Shared mixed/permanent-status budget | D | M: sums get | covered | 504→drop→200 uses0.5/1s;504→403/404 stops immediately after second call. |
| L11 | Retry-After120/date ignored | D | M:429+503/date | covered | ~0.5s first retry; no header wait. |
| L12 | Checksum body truncation boundary | U | K: sums.text() | covered | One sums200 then terminated; no retry, same before/after. |
| L13 | Archive body truncation boundary | U | K: streamed archive | covered | One archive200 then terminated; no retry; staging removed by ordinary error finally. |
| L14 | Null body/cancel rejection/fourth cancel branch | D | M: exact get, synthetic Response shapes | covered | Three explicitly non-HTTP helper pairs; real timers,2/2/4 fetch calls; fourth response not canceled. |
| L15 | Bad checksum content/digest controls | U | O: missing line+wrong hash | covered | No HTTP retry for content validation; no completed install. |
| L16 | Cache/up/IPC entry | C+U | M: fresh up+IPC; O: cache | covered | Cache0HTTP; fresh up and IPC recover504 before synthetic child; IPC hello/reply recorded. |
| L17 | Ctrl-C wait/restarted archive | D+C | M: both PTY interruption states | covered | After exits130; no later request/marker/child; active archive leaves one staging folder. Baseline interrupted-download claim is E04. |
| T01 | Exact regression tests red/green | C | M: both changed scenarios | covered | Pinned base runtime+head tests:2 fail; head runtime+same tests:2 pass,11 filtered. Does not establish the separate full-suite12-pass claim. |
| R01 | Historical real-GitHub outcomes at [2096050d4d](https://git.cafe/pingdotgg/t3code/commit/2096050d4d6b030ee50095521f643c700b2e67e2) | U | O runtime; K if retaining body table | missing | Both indexes explicitly say optional/not run; no linked transcript establishes shell3/4→4/4 or launcher2/4→4/4. Upload original record or remove table; no rerun required. |
| E01 | Every fixture uses a local release server | Claim | K: accurate evidence inventory | contradicted | 254 pairs comprise250 real runtime pairs,3 synthetic non-HTTP L14 pairs,1 regression-test pair. L14 transcripts explicitly say SYNTHETIC FETCH SHAPES, NOT HTTP. |
| E02 | Shell502 and PowerShell same statuses | Claim | K: exact listed-status captures | missing | All S/P request logs lack502; only launcher L03 returns502. 503/507 prove the5xx code class, but cannot prove specifically claimed502 runs. Remove502 from those capture claims or supply transcripts. |
| E03 | Launcher also verified on Node20.11 | Claim | K: declared additional runtime | missing | All launcher manifests name Node26.12.1; no20.11 transcript in current/original indexes or linked bundles. Supply review transcript or remove statement. |
| E04 | Main leaves staging on interrupted download | Claim | K: baseline interruption control | missing | L17 before encounters504 and exits1 before an ACTION; only after is interrupted. Baseline healthy→held archive + Ctrl-C is not captured. Current source is consistent with claim, but no transcript proves it. |
| E05 | Curl exits nonzero on unresolved302 | Claim | K: correct extra-behavior account | contradicted | Foreground curl has no -f and exits0 for302; fetch retries the non-2xx status. S22 and code show this; independent exact-argv diagnostic returns exit0/stdout302/stderr empty. Remove parenthetical for302. |
| E06 | GNU wget retries504 only | Claim | K: native other-transient-status control | missing | GNU wget captures cover504,403,404 and healthy200; no408/429/other5xx probe. Narrow to observed504 behavior or supply native-policy controls; BusyBox no504 retry is directly shown. |

## Evidence locations

Each original row's exact pair directories are in `rows/<ID>/manifest.json` within its family archive. Each listed pair contains `before/transcript.txt`, `after/transcript.txt`, `result.json` (except T01's combined result), exact executed source, `normalized.txt`, `Diff0.diff` and `DiffT.diff`. L14 has `get-fixture.mjs` and no HTTP server; T01 has the exact filtered test commands and source hashes. These paths were opened during this audit.

- [Evidence index (every row, transcripts, diffs)](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/e8ad223e9ffb766e/index.md)
- [matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/bbab77b841cccfb0/matrix.md)
- [shell](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c93fc9aad1a8ca66/shell-transcripts.tar.gz)
- [PowerShell 7](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/a9fa1c9a1b162a96/powershell7-linux-transcripts.tar.gz)
- [launcher](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8ea65e8bc3466aac/launcher-transcripts.tar.gz)
- [regression tests red/green](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/0617969d5be4ded1/regression-transcripts.tar.gz)
- [follow-up validation](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/3004bad928606120/followup-validation.tar.gz)

S24/S25 shell interrupt evidence: `runs-20261110T104353.377874Z/S24-ctrlc-active-{dash,bash}-D` and `S25-ctrlc-backoff-{dash,bash}-D`. No F interruption variant exists. S22 unresolved302: `runs-20261110T103855.860142Z/S22-unresolved-302-{dash,bash}-{F,D}`. S23 local output errors: `runs-20261110T104759.177169Z/S23-write-{error,directory}-{dash,bash}-{F,D}`. P21 local I/O: `runs-20261110T104757.726561Z/P21-write-error-{W,H}`. Launcher interrupted archive: `runs-20261110T104353.377874Z/L17-ctrlc-active`; before exits1 at504 without an interrupt action, after exits130 with one staging directory and peer EOF. These establish the positive “what else changed” behaviors, with E04/E05's limits.

Head/head primary controls are `same-revision-20261110T112746.614134Z/{S05-checksum-504,P14-mixed-W,L01-checksum-504}` in the follow-up archive. Earlier nonempty launcher control is retained and explicitly superseded; all three selected primary controls are empty under the common normalizer. Exact test red/green evidence is `regressions-20261110T104023.882495Z`: two regressions fail against base and pass against after; eleven tests are filtered, not verified there.

The “Evidence” table's successful shell408/429/503/504/507, dropped connection and truncated body statements map to S05-S11/S16-S19. Permanent403/404 map to S12-S14; exhaustion to S15; Retry-After to S20/S29; shell cancellation to S24/S25; PS transports to P01-P19; launcher transient and final messages to L01-L11. E02 records the specifically unobserved502 claims. Body timing statements are supported by the separate exhaustion/fourth-success fixtures, not a claim every one-error fixture waits all three delays.

## Completion and friction

Audit started2026-11-10 12:25UTC with a45-minute ceiling and completed within it. All requested code and existing evidence families were covered; missing/contradicted rows are identified above. Worktree unchanged; no fixture run was used to replace missing existing evidence. A single additional synthetic302 diagnostic ran entirely under a new timestamped subdirectory here; its captured curl PID completed, its server was closed and thread joined. No background process was started or left running. No evidence was deleted. Available disk remained106GB, above the5GB stop threshold.

AI-assisted; verified with the tests and tools listed above.

FRICTION:
- tool | Python urllib downloads received HTTP403; curl fetched every artifact successfully | Use curl for this artifact host.
- forge | Forge/remote head lagged the explicitly requested local merge head | Pin the requested local SHA and verify its scripts tree against captured after; done.

VERDICT: INSUFFICIENT S31, E01, E02, E03, E04, E05, E06, R01