# Proof audit, pass 2

1. **Evidence blocker — R12 does not establish a fifth fetch queued before shutdown.** The [R12 transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/8add12aa93364571/R12-transcript.md) labels the fifth request “queued”, but its raw event sequence shows shutdown while that caller is still in its first upstream-resolution subprocess. Before: caller4 REQUEST 10268.103 ms, SERVICE_CLOSE_REQUEST 10286.354 ms, first upstream lookup FINALIZED 10293.362 ms, common-dir/repository-path resolution completes 10348.853 ms. After: REQUEST 10230.555 ms, SERVICE_CLOSE_REQUEST 10273.248 ms, first upstream lookup FINALIZED 10277.278 ms, repository-path resolution completes 10365.712 ms. The production path resolves upstream and common dir before creating the background-fetch fiber or acquiring its four-slot semaphore. Therefore fifthReady=0 proves absence of a fifth helper, but not cancellation of an already queued fetch. Both sides must be recaptured with an observed fifth background-fetch request past preflight and waiting for a slot before service close. No production change is requested.
2. **Recorded limit — R12 misses the planned aggregate shutdown band.** The actual 4095.733 / 4093.191 ms measurements and serial TERM/KILL sequences support parity, not the matrix's 1000–2500 ms aggregate target. The delivered transcript, index and evidence section already disclose this accurately. This is pre-existing behavior on both revisions; it is not a newly found code regression.

Reviewed PR [#26601](https://git.cafe/pingdotgg/t3code/pull/26601), before [30eb7e7bb1](https://git.cafe/pingdotgg/t3code/commit/30eb7e7bb1ef103fdd6f54081b6a4acf66b3ee4c), after [3c6d27fa7c](https://git.cafe/pingdotgg/t3code/commit/3c6d27fa7c98ab98a23463891452f761aedbdea8). The head worktree matched the full specified SHA and was clean before and after the audit.

I opened all 14 transcripts, both focused test logs, all six final invocation logs, and the six selected native events.jsonl streams and results.json files inside the uploaded raw-attempts archive. I inspected the uploaded driver and Python fixture, the complete three-file production/test diff and the installed process spawner. The pass/fail judgments below use the actual signals, request/start/finalization ordering, returned payloads, lock snapshots and marker/liveness samples; file-presence and hash comparisons were additional integrity checks.

All paired runtime environments use the requested full SHAs. The uploaded driver SHA-256 is ebc4c041c767f7756be00ab0c77dd2e44af336520baad6ae51f8e2f005f60460; the fixture SHA-256 is f7f10c819bdb0bbb8a004b05d04b205406b9b64b11e0e9fbfc128f8a39454cf9. Their hashes match every final selected stream. All transcript JSONL events are exact archived raw events, in monotonic order, and all transcript result objects match raw results. All Before/After headline numbers agree with the raw measurements. R01's overlay is byte-for-byte the tracked head test file (SHA-256 658fb43a1c701d8f9be771b59801a31862964411530e1f62a883c18618b26b30), and the transcript embeds the exact delivered red/green logs.

The driver uses GitVcsDriver.layer, which calls makeGitVcsDriverCore, with NodeServices.layer and ServerConfig.layerTest. Its observer calls native.spawn(command) unchanged; the signal observer calls the original process.kill unchanged. It does not use the separate VcsDriver/layerVcs path or fake time/platform/process handles. Inputs match the fixture scripts. Normal-exit descendant cleanup (R08) is a real additional effect of the change, accurately disclosed in the evidence.

| Row | Status | Audited proof |
|---|---|---|
| R01 | SUFFICIENT | Exact head test overlay; one selected red before, one selected green after; 171 filtered out per side. |
| R02 | SUFFICIENT | A and B, solo controls, eight READY/timeout errors, queued operation classification or successful registration, eight recovery probes. Queue A/B 7936/8044 → 1796/1941 ms. |
| R03 | SUFFICIENT | All four timeout options; omitted/30000 ninth waits for holder finalization; 31000/null ninth starts with eight live holders; recovery 1/1. |
| R04 | SUFFICIENT | Actual 31000 ms timeout; 40059 → 32020 ms; TERM/KILL ordering, unchanged timeout detail, independent pooled probe and zero live helpers. |
| R05 | SUFFICIENT | Default and null interruption; distinct request/finalization/Exit observations; ~8014 → ~1020 ms; interrupted Exits and 8/8 recovery. |
| R06 | SUFFICIENT | Both variants observe genuine index.lock 1→0, cooperative TERM without KILL, successful subsequent real commit and no remaining locks. |
| R07 | SUFFICIENT | All nine 3-second leaves finish naturally; success/allowed17 preserve full OUT/ERR strings; rejected17 preserves structured error, exit code and output lengths; fast status and 8/8 probes. |
| R08 | SUFFICIENT | All three leader exit variants; before child alive at return then natural marker; after child killed and marker absent through READY+8250 ms; exit mappings preserved. |
| R09 | SUFFICIENT | Overflow error 8062→1074 ms with identical detail; zero live helpers after; truncating control naturally completes at ~3 seconds with stdoutTruncated=true. |
| R10 | SUFFICIENT | Two callers coalesce into one actual fetch; five-second waits leave helper alive; real upload-pack completes around eight seconds; old 1000 and new “1 second” options. |
| R11 | SUFFICIENT | Native 300-second safety deadline, TERM then KILL ~1 second later, finalization ~301.1 seconds, no live helper/marker, no same-key retry and successful distinct-key fetch. Failure cooldown is corroborated by no retry long after the original 15-second success-cache lifetime. |
| R12 | INSUFFICIENT | Four-helper interruption/shutdown parity is proven; fifth background fetch was not queued before close. The disclosed ~4.1-second aggregate also misses the planned target. |
| R13 | SUFFICIENT | Ninth actual REQUEST while eight READY holders occupy pool; cancellation before holder release; zero ninth spawn/READY/marker and 8/8 recovery. |
| R14 | SUFFICIENT | Both timeout and interruption; linked worktrees and primed path cache; second real config write waits for hostile owner finalization, then succeeds; value=yes, config.lock 0→0. |
| R15 | cannot-verify windows | Accepted limitation under pass-2 brief; no native Windows claim. |

Recommended native macOS corroboration remains cannot-verify macos, accepted by the brief. No screenshots or browser capture apply to this server-only change. “Preparing workspace” could be optional UI corroboration with the same-server semaphore saturated and a real thread launch in isolated state; it is not required server proof and was not exercised.

The R07 index wording “original OUT/ERR preserved” should be read as full strings for successful/allowed returns; rejected exits expose only structured error metadata and lengths, as recorded in the actual payloads. R13's headline interruptMs includes snapshot/logging overhead: the separate QUEUED_INTERRUPT_COMPLETE event reports 0.605/0.308 ms versus the headline 1.503/1.174 ms. Both establish prompt queued cancellation; no millisecond performance guarantee should be inferred.

## Independent same-machine reconstruction

Ran the uploaded final driver's complete core group at the required head on the same machine, with the uploaded fixture unchanged. The only driver edit was changing its const scratch from the lead's capture directory to this auditor's audit-pass2 directory. The resulting auditor driver hash is 31d986d4ccd92a9dc5e5df08d2f091c52dffd37a7d8c6ef3d619ac6e978fece7. Command, from apps/server:

```sh
GIT_CONFIG_GLOBAL=/dev/null CAPTURE_GROUP=core vp test run src/vcs/scratch26601.auditpass2.test.ts
```

The invocation passed (one capture test, 28 core variants, 109.07 seconds). Its environment records the full required head, Linux 6.1.102, Node v26.13.0, Git 2.43.0, installed platform-node-shared 4.0.5 and 4 available CPUs.

| Reconstructed headline | Delivered head ms | Auditor ms | Delta |
|---|---:|---:|---:|
| R02 A queued worktree | 1796.368 | 1947.482 | +8.412% |
| R02 B queued worktree | 1940.985 | 1975.731 | +1.790% |
| R05 default interruption | 1021.348 | 1017.249 | −0.401% |
| R05 null interruption | 1019.549 | 1013.910 | −0.553% |

All reconstructed R02 holders return the same timeout detail (8/8 per variant), recovery is 8/8, and marker/live counts remain 0/0. R05 retains identical interrupted Exits, 8/8 recovery and 0/0 marker/live counts. No headline exceeds the brief's 25% threshold. A comparison of recorded count/outcome fields across all 28 core variants also found no differences.

Post-run audit checked the 339 driver/fixture PIDs: zero live non-zombie processes and zero remaining *.lock files. The test process exited successfully; its IPC server closed. No browser, app server, emulator, lease, or extra worktree was started. The temporary untracked driver was removed by literal path and git status --porcelain is empty. Only this auditor's scratch subdirectory will be removed after its report and rerun evidence are uploaded; the lead's root and worktree remain intact.

FRICTION:
- tool | web fetch could not open the evidence URLs; Python urllib received HTTP 403, while curl successfully fetched the same immutable URLs | use curl for these evidence downloads.

VERDICT: INSUFFICIENT R12