Peer-link and forwarding takeover proof Repository: https://github.com/pingdotgg/t3code Targets: https://github.com/pingdotgg/t3code/pull/16655 and https://github.com/pingdotgg/t3code/pull/16684 Actual root:1451e7cb23034d29774338608368a15d8845df36 Layers: mode48c6bf4ce66fe11dca0597c6a4a4aa59c65a2fb8; launchebba131607e20705643a10a79e2afc483962af00; peer84a4f73b9ec721840534d00b15084f7c997a7441; forwarding001ecbed8a0214b4d3788563a3a3d01488841bbc. Linux, Node24.21, isolated homes/repository/OAuth clients. No installed user data or real provider accounts used. Current evidence is headless Linux only. Before/after defects: - Same-ID peer capability rollback could send a caller's modes to an old endpoint that ignored them. Fixed resolution checks current capability before reading a bearer. Real wire downgrade now returns incompatible; zero authenticated destination requests; restoring descriptor restores narrowed call. - Failed relink could orphan a newly issued secret; scoped cleanup preserves working row. Real HTTP307 redirects on discovery/OAuth/MCP refused. Structured MCP result preferred over display text. Focused tests exercise actual sockets and controlled mutations. - Keyed accepted launch retried after mutable base/default disappearance failed before durable receipt lookup. Actual Git base deletion and B restart replayed one original idle launch. Accepted retries still validate every explicit existing worktree: production bad-path retry refused, zero messages/runs/effects at that observation. - Thread-wide Stop bounds include queued work created before Stop, while later runs and descendants survive old-key retries. Persisted SQLite cases and controlled mutations exercise queued/partial/delegated races. Production-bundle proof recaptured at corrected forwarding head001ecbed8a: 1 Actual A outside OAuth caller discovered B, forwarded capabilities and preserved mode ceilings: full-access/default capped to auto/default by link; approval-required/plan stayed narrowed. 2 Unknown target, actual read-only caller, local pending attachment, local one-use webhook secret references on both scheduling tools refused before destination bearer. 3 Proxy discarded successful destination launch response after commit. B process restart and exact original caller/key retry returned identical result. One persisted destination thread. 4 Proxy discarded successful send after commit. B process restart and exact key replay retained original thread/message/run IDs; one durable message/run. Recovery cancelled that interrupted run. This does not promise exactly-once provider execution or automatic execution resumption. 5 Controlled real mock-ACP105s run completed after106.435s. A110000ms wait returned completed/timedOut=false; actual forwarded chunks50000/50000/10000ms all named the same original run. 6 Proxy discarded successful Stop response after commit. Old run terminated, B restarted, different run started. Original Stop retry returned old run; new run remained active. A new Stop key cleaned up the new run. 7 Current-head production discovery returned incompatible for same-ID mode-capability downgrade with zero authenticated destination requests; restored capability permitted approval-required/plan. 8 Current production MCP rejects rename without title and regenerate-title with conflicting title as invalid params (-32602); valid forwarded rename succeeds. Verification: previous fd14 head745/745 targeted tests across27files. Corrected001ec head192/192 focused tests across11files plus6/6 forwarding retest after a type-only adjustment; server/contracts/provider-core typechecks; changed-file lint and format; scoped Knip; full-range whitespace check passed. Tests sequential with one worker after parallel memory pressure. Original forwarding suite134/8 ->120/8 by pruning; current same-subset151/8 includes main/prerequisite additions. Peer test baseline13/3 ->15/3 with four reproduced defects before fixes; final peer8cases; prerequisite review scope180/12. Integration added no cases/files, expanded existing incompatible-status case. Independent reviews: peer three rounds per Opus/Sol, then whole four-layer review by both. Post-publication full-stack review by both Opus and Sol found no source blocker at001ecbed8a. Opus independently reran74/74 tests in4files includingMcpHttpServer. Earlier forwarding reviews found Stop cohort/receipt, local secretRef and false delegation guidance, now fixed. Limits: loopback HTTP proxy and two real production Node server processes, not two-host TLS or actual T3 Connect relay/tunnel. No macOS, Windows, Electron, iOS, Android, real provider credential or signed-webhook execution proof. Screenshots are not applicable to server MCP/CLI behavior. Accepted design limits: partial Stop retry can hold current queue/end current watches on original still-current run, but does not stop later-created work; interrupt_requested confirms acceptance, not termination; rejected key needs a new key; old peers ignoring stop only interrupt. Concurrent relinks/crash can orphan unused credentials, row/token stay paired; relink does not revoke old destination session. Descriptor probes/outcome SQL per call retained. Descriptor identity is transport/origin/ID/capability, not cryptographic identity. Human: review permission policy and staged adoption; exercise real multi-machine TLS/relay/tunnel and installed client platforms before rollout. No merge performed. Implementation GPT-6.1-sol, tests GPT-6-Astra, reviews Claude Opus5.5 and GPT-6-Sol through T3 Code. Post-publication corrections at current head: - Accepted deferred launch receipt replay now checks current mode ceilings under the dispatch lock before resuming a still-preparing run. Owner mode-raise regression fails with the old code. Completed lookups remain harmless. - Existing preparing run resumes its durable workspacePreparation; retry-root input cannot redirect worktree preparation. Existing behavioral case fails with old implementation. Idle creates without a run may still receive their first message with a valid project workspace. No immutable payload snapshot added. - Fixed bounded peer-origin/OAuth errors, notification-aware per-event SSE parsing with request-ID matching, and unlink secret-removal failure/retry plus conditional deletion across a relink. Real HTTP/secret-store cases fail with old implementations. - Metadata environment extension preserves object validation checks. Migration64 test runs explicitly through64 so adding65 does not invalidate unrelated exact-list assertions. - JSON codecs aligned with destination advertised schema; the actual ModelSelection transform also passed with old codecs, so no current transformed-field production bug claimed. - Stop bypass suggestion declined after tracing existing central dispatch guard for root and every descendant and strengthening current case; removing that guard fails both root/descendant assertions. No duplicate guard added. - Handler/service retry policy broad refactor and replacing short-lived pairing-code argv with prompt framework declined as nonblocking scope expansion. - CI oldhead web highlighting failed1/8048. Isolated current-head WorkflowOpeningBlock browser suite passed3/3; no web source changed and CI rerun still required.