# Proof audit, pass 1

PR [#33624](https://git.cafe/pingdotgg/t3code/pull/33624), issue [#33616](https://git.cafe/pingdotgg/t3code/issues/33616). Reviewed [17b58caf24](https://git.cafe/pingdotgg/t3code/commit/17b58caf24f000852f1da7893ae0a21b64f828a4) on `fix/issue-33616` against the supplied main merge-base [53bcb9af7a](https://git.cafe/pingdotgg/t3code/commit/53bcb9af7a37dd0b4df11a7d6fa0106e9e5b7356). GitCafe metadata confirms both OIDs. The local `main` ref is stale; it was not used as the comparison base.

## Findings

1. **Blocking proof gap:** the description has a trial summary, but no hyperlink targets at all, hence no linked raw runtime transcript or driver. The claim “server-only ... no captures” conflicts with the repository requirement for a test plus a short runtime transcript. No video or UI screenshot is needed. Rows F2–F5 and F8 are claimed, not independently inspectable runtime evidence.
2. **Regression test is useful, but narrower than its name:** [native.test.ts](https://git.cafe/pingdotgg/t3code/blob/17b58caf24f000852f1da7893ae0a21b64f828a4/apps/server/src/speech/native.test.ts#L163) imports a synthetic module, disconnects from inside its asynchronous feed, keeps the event loop alive, checks request rejection, and checks absence of a JS exit-hook file. The parent remains alive. This distinguishes the old exit teardown from the new handler; it does not reproduce backend death, ggml inference, signal status, or core generation. Keep this test; complement it with native runtime evidence.
3. **Revision linkage is acceptable at the changed-file level:** both changed files are byte-identical between the table's after revision [7a40bb738e](https://git.cafe/pingdotgg/t3code/commit/7a40bb738ec0315b5cbf258f6797e21c877c7a9c) and the reviewed merge head. The table's before revision is [bbdc7dca32](https://git.cafe/pingdotgg/t3code/commit/bbdc7dca320ee4fbc7131498aaffef2fa1eb3d41), not the current main merge-base. A new transcript must label the exact revisions; do not relabel old trials as current-head runs.
4. **No separate code defect established in this proof pass.** The changed handler is unconditional for model workers. Graceful stop/dispose/abort and a worker's own crash are different paths; they must not be presented as proof that this handler ran. SEA, other supported architectures, macOS and Windows remain explicitly unverified.

This pass inspected source, metadata, existing comments/reviews, and CI status. It did not run tests, build binaries, download weights, execute native trials, or produce new runtime captures. Prior reviews target the earlier implementation revision. At the status read, current-head checks had 18 successful, 12 pending, zero failing; CI is not a substitute for the native transcript.

## Paths and equivalence classes

- Production loader: [SpeechService.loadModel](https://git.cafe/pingdotgg/t3code/blob/17b58caf24f000852f1da7893ae0a21b64f828a4/apps/server/src/speech/SpeechService.ts#L354) is the sole production caller of `loadNativeSpeechModel`; direct test callers are in `native.test.ts`. Service entry points are prepare/warm-up, one-shot transcription, and streaming start/feed/finish, including CPU recovery. HTTP prepare/transcribe and the speech WebSocket reach those same service methods. Web, desktop and mobile, including remote/relay clients, converge on the hosting environment's worker; no separate rendered/client/provider fixture is needed. Cloud transcription does not use this worker.
- [native.ts](https://git.cafe/pingdotgg/t3code/blob/17b58caf24f000852f1da7893ae0a21b64f828a4/apps/server/src/speech/native.ts#L136) handles load, begin, feed, finish, reset and transcribe messages. Abrupt backend death or explicit IPC disconnect can reach the changed listener while native model/VAD loading, ASR/VAD/session work, finalization or reset is pending, or between replies with native libraries still loaded. Collapse these to active work (F2/F3/F5) and post-reply/idle (F4): the listener has no operation/option branch. The active fixture must leave the JS event loop responsive; a synchronous JS infinite loop cannot dispatch `disconnect` and is only a parent-kill control.
- Normal `finish()` and `reset()` reply without disconnecting (F6). Stream cancellation first attempts reset; reset failure/timeout, incomplete setup, one-shot interruption, service lifetime abort, idle unload, model replacement/removal, explicit disposal and load-failure cleanup reach parent `stop()`/`dispose()` (F7), which already sends SIGKILL. Automatic load failure may then create a CPU worker. A worker's own SIGSEGV reaches the parent's exit listener, rejects pending work, and permits service recovery/reload (F8); it does not execute a disconnect handler in a dead worker. Backend graceful shutdown normally follows F7; if it exits without cleanup and leaves the IPC channel to close, it instead falls into F2/F4.
- Runtime launch: [speechWorkerArgs](https://git.cafe/pingdotgg/t3code/blob/17b58caf24f000852f1da7893ae0a21b64f828a4/apps/server/src/speech/native.ts#L248) uses the inline module entry for Node and Electron, with `ELECTRON_RUN_AS_NODE=1`. Electron's native-library ASAR path adjustment is a loader difference. SEA uses `__speech-worker model` through [binMain.ts](https://git.cafe/pingdotgg/t3code/blob/17b58caf24f000852f1da7893ae0a21b64f828a4/apps/server/src/binMain.ts#L28) / [speechWorker.ts](https://git.cafe/pingdotgg/t3code/blob/17b58caf24f000852f1da7893ae0a21b64f828a4/apps/server/src/cli/speechWorker.ts#L5) and `runNativeSpeechWorker`, then evaluates the same inline handler (F9). GPU discovery selects `discoveryEntry`, which has no changed disconnect listener; exclude it. `auto`, explicit GPU, CPU, VAD, streaming/offline, language and vocabulary do not alter the listener; separate CPU only to substantiate the table's distinct backend-registration claim.
- Supported hosts from [platform.ts](https://git.cafe/pingdotgg/t3code/blob/17b58caf24f000852f1da7893ae0a21b64f828a4/apps/server/src/speech/platform.ts#L1): GNU Linux x64/arm64, macOS x64/arm64, Windows x64. This VM is Linux x86_64. Linux musl and other host pairs are excluded by the service gate. macOS/Windows termination semantics are not verified by Linux runs.

## Capture recipe and shared data

Every row uses a **runtime/test transcript**, never `recording`: event order, request results and collected exit status are sufficient for this server-only change. A still screenshot alone is insufficient. No video adds necessary evidence.

Data N for real-native rows: `transcribe-cpp@0.4.1`, `@transcribe-cpp/linux-x64-cpu-vulkan@0.4.1`; ASR weights `parakeet-unified-en-0.6b-Q8_0.gguf`, 731357568 bytes, SHA-256 `4b50b6dd862bf6e346929aaf4f5eaacec003bfa3f56462d6c874b41ef2f38795`; reproducible 16-kHz mono float PCM with its generation recipe or checksum, 5120-sample / 320-ms feed chunks, `{ timestamps: "none" }`, no optional VAD for the minimal run. Record requested and actual backend, loaded library variant, runtime versions and binary paths, OS/architecture, source revision, native package/weights hashes and command line.

Linux driver method D: place all driver code, weights/downloads and logs in this audit's scratch directory; import the reviewed `loadNativeSpeechModel` by absolute path, do not duplicate its worker entry or change the worktree. Run a stand-in backend under a Linux subreaper (`PR_SET_CHILD_SUBREAPER`); retain only spawn-reported backend/worker PIDs. For active trials, establish that native feed has actually been entered and is unresolved (e.g. an instrumentation-only module proxy calling the real native stream, with an entry notification after starting the native promise); merely sending a parent `feed` request is not enough. Have the subreaper SIGKILL only its spawned backend, adopt the orphan, and collect raw `waitpid` status for both processes, including signaled/exited/core-bit decoding and native stderr. For post-reply trials, acknowledge a real feed reply before killing the backend, and start no next feed. Show all trials including clean before exits; races need not fail every time. Fixed orphan status must be SIGKILL rather than SIGSEGV/exit 0. Stop/reap every owned process before completion. These are instructions for the next pass, not a claim that D was executed here.

A short human-readable transcript may summarize counts if it links the complete per-trial statuses and the driver that rebuilds them. Upload the driver plus transcript and link them in the PR. The absence of a driver alone is not a separate repository-rule violation; here neither driver nor transcript is available to inspect the table's setup/results.

## Fixture matrix

“Minimum” separates required defect proof from evidence needed to retain the PR's extra claims. Control rows share one focused test run; no Cartesian product of all options is needed. `source-covered` means inspected test/code, not a fresh passing execution.

| ID / named fixture | Distinct condition and data | Diff affected? | Minimum capture / expected result | Produce on this Linux VM | Existing PR coverage and status |
|---|---|---|---|---|---|
| F1 — disconnect teardown sentinel | Synthetic streaming module, pending async feed, explicit child IPC disconnect, JS exit-hook marker | Yes; direct handler proof | Required test evidence; transcript of regression failing before / passing after; pending feed rejects and marker stays absent after | Run `vp test run src/speech/native.test.ts` from `apps/server`, with `TMPDIR` under audit scratch; preserve output. Use an isolated before source/baseline supplied by the lead without editing this read-only worktree | New committed regression and textual fail/pass claim exist. **source-covered**; no native inference or backend death proven |
| F2 — Node active / auto | N; Node 26, acceleration auto; backend dies during actual native feed | Yes; primary reported defect | **Required runtime transcript**; before failure reproduced with trial counts, after worker waitpid SIGKILL, backend waitpid SIGKILL | D under Node; native-entry/pending barrier plus subreaper | Table: before SIGSEGV ×7 + exit 0 ×1; after SIGKILL ×8. **missing-transcript** |
| F3 — Node active / CPU | N; Node 26, explicit cpu (`TRANSCRIBE_BACKENDS=cpu`); same timing | Yes; same handler, different native registration | Transcript required to retain this specific table claim; same statuses as F2 | D with `acceleration="cpu"`; log actual backend/library | Table: before SIGSEGV ×5; after SIGKILL ×5. **missing-transcript** |
| F4 — Node after feed reply | N; Node 26 auto; one real reply acknowledged, no request pending when backend dies | Yes; idle/post-reply handler reachability | **Required boundary transcript**; ordering and orphan SIGKILL after; preserve mixed before results | D with reply barrier instead of active-feed barrier | Table: before SIGSEGV ×1 + exit 0 ×4; after SIGKILL ×5. **missing-transcript** |
| F5 — Electron active / auto | N; Electron 44 run-as-node; same native feed/backend-death sequence | Yes; desktop runtime shares entry | **Required desktop-runtime transcript**; prove Electron runtime, actual native load, backend/worker statuses | D launched by Linux Electron executable with `ELECTRON_RUN_AS_NODE=1`; record exact version and library path; no GUI/browser needed | Table: before SIGSEGV ×4 + exit 0 ×1; after SIGKILL ×5. **missing-transcript**; not proof of packaged ASAR execution |
| F6 — normal completion / reset / reuse | Live backend; begin/feed/finish, reset/cancel success, next recording | No handler invocation; control | Existing focused-test transcript suffices; text/results valid, worker remains reusable until disposal | Existing streaming-preview/reset and isolated transcription tests in `native.test.ts`; same F1 file run | Existing committed tests exercise finish, reset and reuse; description says all 10 passed. **source-covered**, not a runtime-table row |
| F7 — dispose / abort / stop | Live backend; idle or pending worker; dispose, abort, shutdown, unload/model change, failed load cleanup | No; parent already SIGKILLs worker | Existing focused-test transcript suffices; pending rejects, dispose resolves; pre-aborted signal spawns no worker | Existing isolated-dispose and hung transcription/feed abort tests; optional D control can collect kill status. Do not confuse a hung synchronous fixture with an event-dispatched disconnect | Tests cover disposal and abort with hung work; other callers collapse to the same stop function by source. **source-covered**, no native stop runtime claim |
| F8 — worker crash containment | N; Node auto; SIGSEGV worker during feed while backend is alive | No; parent's exit/recovery path | Transcript needed to retain containment claim; pending rejects with SIGSEGV, backend remains responsive. If restart is claimed, show fresh load and successful reply too | D kills only its captured worker PID, records rejection plus backend liveness and eventual cleanup; no backend kill until observations complete | Table says backend stays up / feed rejects before and after. **missing-transcript**; earlier comment reports synthetic coverage, not this native run |
| F9 — packaged SEA dispatch | Linux x64 SEA binary from reviewed source; `__speech-worker model`, IPC and native package on disk | Yes; same handler, distinct launcher | Optional launch/disconnect smoke transcript; full native repeat not minimum for this one-line fix. Keep limitation explicit if omitted | Build/provide a matching Linux SEA outside the worktree, drive public loader from packaged backend; subreaper collects child status. Calling command under ordinary Node does not prove SEA | Explicitly not run. **unverified-sea**, source-equivalent handler only |
| F10 — macOS termination | Supported macOS arm64/x64; Node/Electron/SEA worker disconnect active or idle | Yes; OS/runtime boundary | No Linux capture can verify it; disclose exclusion, no extra per-operation matrix | Cannot execute native macOS runtime on this VM | Explicitly not run. **cannot-verify macos** |
| F11 — Windows termination | Supported Windows x64; Node/Electron/SEA worker disconnect active or idle | Yes; OS termination boundary | No Linux capture can verify it; disclose exclusion; do not assert POSIX waitpid/SIGKILL status format for Windows | Cannot execute native Windows runtime on this VM | Explicitly not run. **cannot-verify windows** |
| F12 — Linux arm64 | Supported GNU Linux arm64; same lifecycle, architecture-native library | Yes; native architecture boundary | Not minimum for the reported x64 fix; disclose architecture limit | No native arm64 execution available in this x86_64-only pass; cross-build is not execution proof | No trials reported. **cannot-verify linux-arm64** |

Minimum new defect captures: F2, F4, F5; retain F1 regression evidence. To substantiate the existing table without trimming its claims, also attach F3 and F8. F6/F7 need no new native matrix expansion; include their existing focused-test results in the test transcript. F9–F12 are explicit limits, not silently passing fixtures.

## Coverage and closeout

Covered full two-file diff, production loader and worker entry, parent lifecycle, service callers, HTTP/WebSocket entry points, runtime launch variants, supported-host gate, PR description and existing review/CI context. No browser/GUI work, worktree edits, forge comments, pushes, or persistent processes were started. Only audit scratch files were written; no evidence was deleted.

AI-assisted; verified with the tests and tools listed above.

FRICTION: none

VERDICT: INSUFFICIENT F2 F3 F4 F5 F8 missing linked runtime transcripts and reproducible driver evidence