# Proof audit, pass 1

[PR #33628](https://git.cafe/pingdotgg/t3code/pull/33628), branch `fix/issue-33623`, reviewed head [e039e17308](https://git.cafe/pingdotgg/t3code/commit/e039e17308b32c280903c5dd4cd82f2457e0d8f0), base and merge-base [53bcb9af7a](https://git.cafe/pingdotgg/t3code/commit/53bcb9af7a37dd0b4df11a7d6fa0106e9e5b7356). PR description snapshot: version 7, fetched 2026-11-10 01:14 UTC. Read-only source and existing-evidence audit; no new runtime captures, tests, edits, pushes, or comments were made.

## Findings

1. **Proof incomplete: missing runtime controls and lifecycle recordings.** Existing evidence demonstrates the reported race for both signals and one fast-shutdown control. It does not record normal crash recovery without a server signal, a connector exit queued before the signal but decided afterwards, a signal during crash-loop backoff, or scoped listener removal and rebuilding. The two new tests exercise only signal-before-clean-exit with mocked process handles; the existing crash test exercises a nonzero exit without a signal. These tests do not establish the missing runtime timing or listener-lifetime behavior.
2. **Artifact delivery incomplete.** The timestamped transcript and driver/stub/runner are pasted inline in the PR description. No uploaded transcript, raw relay log, driver log, runner log, or reproducible script artifact is linked. Upload the existing files with `ghdrop upload -m` and link them; do not recapture A1-A3 solely to change delivery. If the underlying files are unavailable, preserve the inline transcript as a labelled excerpt and recapture only what cannot be recovered. The published excerpt omits the runner's final leftover-process report and the driver's shutdown-finalizer markers. All driver captures must be labelled **production-runtime harness, synthetic config and stub connector**, not full desktop/server runs with Cloudflare.
3. **The older revisions are valid for this proof.** Before [bbdc7dca32](https://git.cafe/pingdotgg/t3code/commit/bbdc7dca320ee4fbc7131498aaffef2fa1eb3d41) and after [96aec6c162](https://git.cafe/pingdotgg/t3code/commit/96aec6c1622b7de69b6a7146cca82f01972b3833) remain relevant. The merge changes neither runtime nor test. Comparing the old base with the new base also leaves the shutdown callers, runtime dependencies, relay config contract, desktop backend manager, and shared relay/process helpers unchanged. Lockfile changes concern the diff/highlighting packages, not Effect or its Node spawner. Main does change nearby cloud public configuration, authentication, and environment capability reporting, but none is on the supplied harness's shutdown path. New head captures are not required solely because of the merge.
4. **Scope limits, not proven defects.** The new guard stops the supervisor's restart log, recovery queue offer, and reconcile call after it observes the signal; it still closes the exited connector first. It does not cancel a restart that passed the guard before the signal, nor guard direct `applyConfig`, installer swaps, HTTP/2 fallback reconciliation, registration/auth recovery, or externally requested recovery. Do not describe it as a global shutdown barrier. The provided scripts also never emit a registration line: their age-based “connected” state is a stub model, not observed Cloudflare readiness. Their common TERM/INT trap always prints `SIGTERM`, so the SIGINT runner line identifies the actual signal; improve that label when adding captures, without treating the old label alone as a failed SIGINT run.

## Fixture matrix

All timing/lifecycle interactions below are **recording**: a timestamped runtime transcript, with full relay-client log and driver/runner milestones. “Minimum” identifies the smallest required runtime set for this audit; other rows enumerate equivalence classes and boundaries without requiring an exhaustive Cartesian product. A1-A3 already have adequate inline content for their central restart/timing claim; their status remains incomplete until artifact delivery is fixed. Every accepted old capture inherits finding 3's revision validity.

Common data: isolated T3 home; managed policy allowing Connect; `{ providerKind: "cloudflare_tunnel", connectorToken: "synthetic-token", tunnelId: "tunnel-1" }`; available PATH connector; real `CloudManagedEndpointRuntime`, Node spawner and NodeRuntime. No production credentials. Optional `tunnelName` does not affect the signal branch.

| Row / named fixture | Data, ordering, and expected observation | Diff effect / minimum | Seeding / capture type | Existing PR-body evidence and status |
|---|---|---|---|---|
| A1 — TERM, slow predecessor | Signal group with SIGTERM after stub age >2s; predecessor finalizer 1000ms, child exits promptly. Before: original stops, replacement starts and is stopped while registering. After: original stops, no replacement. Record shutdown duration and any recovery event. | Direct changed path; **minimum** | Existing driver + stub through production runtime; **harness recording**. Real app equivalent: linked desktop backend with a preceding slow teardown. | **CONTENT COVERED / UPLOAD MISSING**: 3351ms → 1049ms, complete start/stop sequence in excerpt. Recovery queue is not sampled by the existing driver; code shows the offer is skipped. |
| A2 — INT, slow predecessor | Same as A1, SIGINT to foreground-style process group. Same restart suppression. | Separate signal listener; **minimum** | Existing runner with `SIG=INT`; **harness recording**. Real app equivalent: terminal Ctrl+C with managed connector. | **CONTENT COVERED / UPLOAD MISSING**: 3353ms → 1052ms. Stub's shared trap mislabels INT as TERM; runner documents INT and both production signal listeners exist. |
| A3 — fast teardown wins | SIGTERM, predecessor delay 0; finalizer clears config/stops connector before restart. Before and after remain fast and spawn only once. | Unchanged race control; **minimum** | Existing `SLOW_MS=0`; **harness recording**. SIGINT with this ordering is equivalent after A2 independently covers its listener. | **CONTENT COVERED / UPLOAD MISSING**: 91ms → 97ms. This is an observed ordering control, not a guarantee that every zero-delay scheduling will order identically. |
| B1 — crash first, signal later | No server signal: nonzero child exit, same desired config; observe one recovery request and replacement. Then signal the server after replacement is observed; no further shutdown replacement. | False branch of new guard and exit-before-signal completed decision; **minimum** | Add controlled child exit to driver; subscribe to `recoveryRequests` and timestamp replacement before signalling; **harness recording**. Real app: kill only tracked connector PID, then stop server. | **MISSING RECORDING**. Existing `supervises the active connector...` test covers exit code 1 and replacement, but PR has no runtime crash control. One recording can cover both phases. |
| B2 — exit queued before signal | Hold reconcile lock using public `restartConnector(pid, stillDead)` with an event-gated check returning false. Child exits while lock is held; server receives TERM before lock release; predecessor finalizer keeps runtime alive. After release: stop old child, no restart/recovery on fix. Before: restart. | Guard evaluated after async lock wait; **minimum** | Driver event gate, real child and real runtime; release gate on a recorded signal milestone; **harness recording**. Do not synthesize private refs. | **MISSING RECORDING**. New tests send signal before resolving exit and do not exercise this ordering. Repeat INT is unnecessary after A2 covers that listener. |
| B3 — signal during crash backoff | First short-lived crash establishes backoff; next connector exits <30s, observe 1000ms delay log, signal server while delayed. Keep predecessor teardown longer than remaining delay so the guard is actually reached. Fix: no additional replacement/recovery; before: restart after delay. | Guard evaluated after timed delay; **minimum** | Scripted stub crashes and timestamped delay milestone; **harness recording**. Use one positive delay, not every doubling/cap. | **MISSING RECORDING**. All existing captures involve first exits and zero restart delay. |
| C1 — child outlives finalizer entry | Signal while stub is still in slow-stop phase (<2s age), or have stub linger beyond predecessor finalizer; runtime close must wait for original child, with no extra spawn. Existing child shutdown latency remains. | Finalizer wins / slow-child boundary; additional control, not minimum beyond A3 and C2 | Driver signals early and logs stop milestones; **harness recording**. Real Cloudflare registration is an optional stronger check. | **NOT CAPTURED / NON-MINIMUM**. Existing replacement's slow stop demonstrates the stub model only; it does not record a slow original connector on fix. |
| C2 — close without signal | Live connector, no OS signal; close runtime layer, observe original stops, no restart/recovery, process remains usable. | Normal scoped cleanup remains correct; **minimum**, can share C3 recording | Long-lived driver explicitly closes runtime scope; **harness recording** with real child. Real app equivalent: service/runtime handoff or orderly scope shutdown. | **MISSING RECORDING**. Existing start/deduplicate/rotate/stop test explicitly calls `applyConfig(null)`; test teardown implicitly closes layers but does not assert listener cleanup. |
| C3 — listener ownership and fresh layer | Record baseline listener identities for INT/TERM; build layer (+1 each on fix), deliver signal with a host handler that keeps driver alive, close layer, verify exact baseline restored for both. Build fresh layer and show no inherited shutdown latch via a normal child crash/restart, then close. Preserve unrelated host listeners. | Newly acquired resource and both `process.off` branches; **minimum**, share C2 | Lifetime-specific driver using real runtime and real child under a host that intentionally survives signals; **labelled harness recording**, not NodeRuntime server shutdown. Include normal no-signal close as C2 phase. | **MISSING RECORDING / NO EXPLICIT TEST ASSERTION**. No current transcript or assertion measures listener removal or latch reset. |
| D1 — exit result shapes | Child clean exit 0, nonzero exit 1, or untrapped signal causing Node spawner's `exitCode` Effect to fail. All feed same guard; without server signal all restart, with signal all suppress. Logger uses `exitCode` vs `cause` only after guard. | Data-equivalent guard; no extra minimum recording beyond A1/A2 clean exit and B1 nonzero | Add child-only SIGKILL for error-result variant if desired; **harness recording**. Not a fabricated process-handle error. | **PARTIAL / NON-MINIMUM**: clean 0 covered inline; nonzero 1 tested; exit-failure variant unrecorded. Result shape does not influence the new predicate. |
| D2 — no active/stale/config shapes | `null` → disabled; `manual`/`t3_relay` → unsupported/no connector; policy denies Connect → effective null; missing/unsupported executable or failed spawn → no active supervisor. Same config deduplicates; token/id/name changes rotate. Old pid/config key exits before/after semaphore are ignored. | Unchanged defensive branches; no extra minimum | Public `applyConfig`, isolated policy/executable layers, controlled stale child exits; **harness recording if enacted**. A mismatching desired config with matching active ownership under the lock is not normally seedable through public API; do not mutate private refs just to capture it. | **SOURCE/TEST EQUIVALENCE / NON-MINIMUM**. Existing suite covers start/deduplicate/token rotation/stop and failed install/swap paths. Optional id/name only affect config key/labels, not signal logic. Inline captures include id and omit name. |
| D3 — induced exits and other recovery | Reachability `restartConnector` or readiness watchdog kills child → same supervisor, so signal predicate applies. Registration timeout/rejected-token requests, startup/external `requestRecovery`, installer swaps/retries and QUIC→HTTP/2 reconciliation have independent unchanged paths. Already selected restart/reconcile may finish after signal. | Supervisor caller equivalence plus explicit unchanged boundaries; no extra minimum for this focused fix | Real runtime driver can call `restartConnector` and feed controlled output; full server provides actual recovery consumer. In-flight install/recovery gates require **labelled harness recordings** if asserted. | **PARTIAL / NON-MINIMUM**: existing tests cover forced restart, fallback, recovery and swaps, but no shutdown interaction transcript. No existing evidence proves a universal no-spawn-after-signal guarantee; PR should keep its claim scoped. |
| E1 — actual desktop/cloudflared | Real linked T3 Connect tunnel, actual cloudflared, desktop quit with slow teardown; compare relay logs and total backend stop. | Stronger platform integration, not minimum for production-runtime harness proof | Isolated real app state and account; macOS desktop recording of server logs/timing. It is seedable with account/device access; not attempted in this audit. | **EXPLICITLY UNVERIFIED / NON-MINIMUM**. PR acknowledges this limitation; do not present Linux stub timing as macOS or Cloudflare measurement. |

Minimum remaining work: upload existing A1-A3 artifacts and scripts; add B1, B2, B3, and one combined C2/C3 recording, each before/after. That is four new recording pairs, not an exhaustive new capture sweep. B1 records ordinary crash recovery before the server signal; B2 and B3 record a pre-signal exit whose restart decision happens after the signal. Instrument new recordings with recovery-event counts/identities, signal send/receipt, child exit, predecessor finalizer start/end, runtime close, total duration and tracked-process cleanup. Preserve the raw logs. The existing A1-A3 content need not be rerun solely because their commits predate the merge.

## Code-path inventory and collapsing rationale

- [Scoped signal listeners](https://git.cafe/pingdotgg/t3code/blob/e039e17308b32c280903c5dd4cd82f2457e0d8f0/apps/server/src/cloud/ManagedEndpointRuntime.ts#L231): INT and TERM set one layer-local latch; normal close and signal close both release it. All runtime status shapes still acquire these listeners, even when no connector starts. C3 checks ownership, both removals and independent next-layer state.
- [Supervisor](https://git.cafe/pingdotgg/t3code/blob/e039e17308b32c280903c5dd4cd82f2457e0d8f0/apps/server/src/cloud/ManagedEndpointRuntime.ts#L334): one launch site in `reconcileConfig`, once for each new connector. Exit success/failure → initial ownership check → stable-uptime reset or exponential backoff (0/1s/.../60s) → semaphore → second ownership check → clear active → stop scope → signal/config guard → restart warning → recovery queue offer → reconcile. A1/A2, A3, B1, B2 and B3 cover distinct shutdown orderings; unchanged cap/uptime arithmetic and output-only metadata do not merit a new capture each.
- [Config and finalization](https://git.cafe/pingdotgg/t3code/blob/e039e17308b32c280903c5dd4cd82f2457e0d8f0/apps/server/src/cloud/ManagedEndpointRuntime.ts#L845): public `applyConfig` owns desired config under semaphore; finalizer calls it with null. CloudLink callers are managed activation/recovery, confirmed-origin startup, relay config apply, eligible shutdown release, and unlink. Shutdown release can return before clearing config for absent runtime config, non-CLI-managed links, update handoff, absent CLI token, or absent relay URL. All retained-config variants collapse to A1/A2; early clearing collapses to A3/C2/D2.
- [Restart caller](https://git.cafe/pingdotgg/t3code/blob/e039e17308b32c280903c5dd4cd82f2457e0d8f0/apps/server/src/cloud/ManagedEndpointRuntime.ts#L866): ConnectReachability calls `restartConnector(pid, stillDead)`; no active connector, wrong pid, or false predicate returns false. Successful child kill relies on this same supervisor. Internal readiness watchdog also kills the child; HTTP/2 fallback and install completion instead call reconcile directly.
- [Server recovery consumer](https://git.cafe/pingdotgg/t3code/blob/e039e17308b32c280903c5dd4cd82f2457e0d8f0/apps/server/src/server.ts#L1028) runs CloudLink recovery for queued configs. Suppressing the supervisor offer prevents that trigger, while other offers remain unchanged. `tunnelConnected` wakes held hooks; readiness/inspection feeds reachability and guest hostname lookup. Those read-only consumers and web/mobile/desktop clients introduce no separate implementation branch for this server-local signal flag.
- [Desktop stop](https://git.cafe/pingdotgg/t3code/blob/e039e17308b32c280903c5dd4cd82f2457e0d8f0/apps/desktop/src/backend/DesktopBackendManager.ts#L446) uses TERM with a termination grace; CLI uses NodeRuntime signal interruption. The relay child is explicitly non-detached. TERM/POSIX foreground INT are the relevant signal kinds; SIGKILL cannot execute this listener and is outside the fix. Parent-only TERM also reaches the same latch; child exits caused later by finalization collapse to A3/C2.

Verification performed: full two-file diff and surrounding runtime/test code, contracts, direct callers/consumers, NodeRuntime/Node spawner implementations, PR description/reviews/check snapshot, and merge/dependency relevance inspection; `git diff --check` passed. No test execution or new capture was claimed. Worktree remained clean. No persistent processes were started. Completed within the 45-minute budget.

FRICTION: none

VERDICT: INSUFFICIENT A1-A3 artifact links; B1-B3 and C2-C3 runtime recordings