# Proof audit PASS2 — terminal fallback pacing

Read-only audit for [#16874](https://git.cafe/pingdotgg/t3code/pulls/16874), also [#16874](https://github.com/pingdotgg/t3code/pull/16874). No auditor checkout switches, repository edits, commits, pushes, review posts, browsers, or live T3 state access by this auditor.

## Source binding

Original captures BEFORE [5a969c17e7](https://github.com/pingdotgg/t3code/commit/5a969c17e76301e45e53e1fd9aad2f5b4599d865), AFTER [a77f9be73a](https://github.com/pingdotgg/t3code/commit/a77f9be73aec486def0b419b80431f9a853a423c). Final merge candidate [cca46259f5](https://github.com/pingdotgg/t3code/commit/cca46259f59d82f31c7277cc2129b4a7185df890). Manager.ts, Manager.test.ts and processRunner.ts are byte-identical AFTER→final and BEFORE→latest main [945fd1df71](https://github.com/pingdotgg/t3code/commit/945fd1df71) (resolved locally). Source-before and shutdown-source-after are equal and clean in all 12 original captures. Every archived Manager SHA256 matches git content at its recorded SHA.

Manager SHA256 BEFORE: ddcb689fd3bd586551b7e0defd92aea8dc516d1c7fd988d9355d4772f8b27770.
Manager SHA256 AFTER/final: 80d96ddb01a9d0b7c4b613c77f653a362badc04b6162abcf2e018ffaddb9f5c9.
ProcessRunner SHA256 all four revisions: c9cb24f0e677968f016b4c4cbf1746e91be40c8c1a08271ee99371711d26d7dd.

## Original evidence reconciliation

Downloaded and opened every nested capture in the [sanitized archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/9d6f4b7fb06f5564/sanitized-before-after.tar.gz). Parsed every RPC, query, /proc sample, native invocation transcript and JSON capture; opened table/mode files and both manual cleanup records. Compared all 12 rows against [matrix JSON](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/ffb518bc53bc44ee/measured-matrix.json) and [matrix prose](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/4e2dbddee62732f8/measured-matrix.md). Recomputed window counts, precise query-start gaps, completion-to-next-start gaps and sampled live peak. Independently extracted busy labels from raw metadata and verified fixture child PIDs/parents against terminal records and the controlled process table. No mismatch found.

| Case | BEFORE window starts at 0/10/20/30/40/50/60s | AFTER | Busy BEFORE→AFTER | Sampled peak BEFORE/AFTER |
|---|---|---|---|---|
| fast, one | 1/3/4/4/5/5/5 | 1/3/4/4/5/5/5 | 1→1 | 1/1 |
| slow, one | 1/3/4/4/5/5/5 | 1/1/2/3/4/4/5 | 0→1 | 1/1 |
| fast, twenty | 1/2/3/4/4/4/4 | 1/2/3/4/4/4/4 | 20→20 | 1/1 |
| slow, twenty | 1/2/3/3/4/4/4 | 1/1/2/3/3/4/4 | 0→20 | 1/1 |
| hung, twenty | 1/1/2/3/3/3/3 | 1/1/1/1/1/1/1 | primed 20→20 | 1/1 |
| close, original INVALID cleanup | 1/2/3/4/4/4/4 | 1/2/3/4/4/4/4 | primed 2→2 | 1/1 |

The 2.5s controlled slow queries complete successfully AFTER; baseline queries time out. AFTER completion-to-next-start gaps: single 10.579/10.884/10.253/16.058s; twenty 10.319/10.543/16.053s. Busy metadata first arrives 29.787ms after the first slow completion (single), 19.779ms (twenty), before the next query. Native-monitor failure continues exponential backoff even when fallback succeeds. Thus these fixtures do not establish a fixed 1s fast-fallback cadence. Fast single has approximately 2/4/8/16s start gaps and fast twenty 4/8/16s in both revisions. Twenty terminals share the query; the sampled concurrency peak is one. A 20ms query can be missed between 50ms samples; START/END are stronger evidence of its existence.

AFTER hung queries ignore SIGTERM, record one TERM each, and disappear after 15.890/15.987s. The next query starts 60.050s after observed disappearance, 75.940s after the prior start. Baseline hung queries disappear near 2s, then wait approximately 8/16/32/60s. Capture cleanup reports no surviving query or terminal identities in the ten non-close rows. This is a Linux controlled helper measurement, not Windows process-tree proof.

Original close replies are 9.561ms BEFORE and 10.595ms AFTER; closed/remove events precede the reply by about 0.5–1.3ms. Raw transcripts contain no later activity or metadata upsert for the closed terminal, including after gate release. However actual background sleep children survive teardown in both original close rows: BEFORE PID1115437/start34439740, AFTER PID1108281/start34385161. Original validCapture:false results are retained. Exact-identity manual cleanup records aliveAfter:false. These rows cannot support a clean-teardown claim and must remain explicitly invalid; supplemental terminal-owned fixtures must be assessed separately.

## Code and verification limits

Source uses one shared process table per polling tick; both POSIX and Windows background fallback budgets are 15s. Successful Result values are applied before waiting. The next wait is min(max(existing exponential backoff,4×fallback elapsed),60s). Native success and custom inspectors contribute zero fallback duration. Result captures typed fallback failure without reconstructing its error. closeIdle separately passes 1s POSIX / 1.5s Windows budgets while holding its thread lock. The terminal.close RPC experiment does not measure closeIdle; the focused deterministic closeIdle tests cover those budget boundaries.

[Supplied test log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/fefac6a63951f209/final-tests.log) reports one file/49 tests passing. [Lint log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/808fff0bf06936f9/final-lint.log) contains one prefer-array-find warning. [Typecheck log](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/56658531650e5544/final-typecheck.log) contains suggestions, no error diagnostics. These logs do not independently embed a git SHA or exit status; source binding relies on the parent’s invocation record. The auditor has inspected rather than rerun them.

Windows PowerShell/WMI, Windows arm64, native monitor success, installed desktop, mobile, UI and remote/tunnel connections are unverified here. Controlled ps output demonstrates server fallback behavior, not real host command-name parsing. A screenshot would add no evidence to this headless RPC experiment.

## Supplemental close proof

Opened the [final matrix](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/cd1aa3d052ffff64/final-matrix.md), [supplement summary](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/b5ed9766da46d711/supplement-close.md), every nested capture/transcript in the [supplement archive](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/c9f95cd6273af7a7/sanitized-supplement-close.tar.gz), [final scripts](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/f216c11bcc62a0dc/reproduction-scripts-final.tar.gz), and all 349 entries in [cleanup verification](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/caedb2abb0f34315/cleanup-verification.json). Supplemental scripts differ only by selecting a driver whose fixture disables job control and traps EXIT/HUP/TERM to kill its captured child. This supplies explicit fixture lifecycle ownership; it does not establish general process-tree cleanup.

Both supplemental summaries reconcile with raw transcripts, window query counts, sampled concurrency and source guards. BEFORE 5a969c17e76301e45e53e1fd9aad2f5b4599d865 closes in 12.678534ms; AFTER final cca46259f59d82f31c7277cc2129b4a7185df890 closes in 9.046191ms. Metadata removal occurs 1.138085ms / 0.590908ms before the close reply and before gate release. Both terminals first show exact ev-case-N busy labels. No later activity or metadata upsert revives the closed terminal. Each capture observes one minute after aligned query start and reports validCapture:true, stable clean source, fixtureSurvivors:[], terminalSurvivors:[], and query survivors:[]. Peak sampled queries remains one. Independently rechecked all recorded query/terminal PID+startTicks identities; none live. The published cleanup manifest covers 14 servers, 71 queries, 264 fixture identities (349 total); all report gone/nonlive. Server PID checks lack startTicks but all recorded PIDs are absent, rather than merely reused.

## Independent reproduction

After the parent explicitly released the server/checkout and authorized reproduction, independently ran the supplied original single slow row on exact final cca46259f59d82f31c7277cc2129b4a7185df890. Only scratch path literals were redirected from /tmp/ev-16874 to /tmp/ev-16874-audit/scripts in the local runner/namespace launcher. Fixture, production entrypoint, observation and summarization logic were unchanged.

Command: python3 /tmp/ev-16874-audit/scripts/run.py --sha cca46259f59d82f31c7277cc2129b4a7185df890 --label audit-slow --mode slow --terminals 1 --seconds 60.

[Independent sanitized transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/431bef53ce5084aa/sanitized-evidence.tar.gz): five completed 2.5005–2.5006s queries; window starts 1/1/2/3/4/4/5; peak sampled live query one; exact busy label ev-case-1. Start gaps 12.768721/12.752618/12.761835/18.559396s; completion-to-next-start 10.268150/10.251974/10.261291/16.058769s. First busy metadata arrives 12.206407ms after first completion. This independently reproduces slow-result retention, immediate publication and elapsed-time pacing with later existing backoff. Result validCapture:true, driverExit:0, sourceStable:true, both survivor arrays empty. HEAD/status/Manager hash remain equal and clean before/after. Runner exited zero; server stopped and waited. [Independent cleanup recheck](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/6624dc734440e0f6/audit-cleanup.json) confirms the captured server PID is absent and all five query plus two terminal identities are nonlive.

Exact independent case cleanup target: /tmp/ev-16874-audit/scripts/20261025-010653-audit-slow. All auditor scratch material is under /tmp/ev-16874-audit. No server remains. Scratch directories are retained for handoff; private/, home/ and server.log were not uploaded.

## Body audit

Read /tmp/ev-16874/replacement-body.md without writing it, including the updated final evidence links. Current takeover and measured table statements match source and captures; original implementation/verification text is explicitly superseded as historical. Baseline slow helpers disappear at 0.95–1.02s, so the draft’s “near 1s” is supported; the ~2s baseline disposal is specific to the separate SIGTERM-ignoring hung fixture. The auditor initially conflated those fixtures in commentary and corrected the mistake against their raw measurements.

The 43→49 source-test delta is consistent with six added parameterized cases. Final test log establishes 49 pass, not failure-under-mutation or review verdicts. Read the subsequently supplied /tmp/ev-16874/delegated-verification.json export in full: six completed task_status records, four review returns (Sol/Opus, rounds one and two), the original test agent return, and the fix agent return. All four review summaries end VERDICT: MERGE. Round-one Opus identifies closeIdle lock latency; round-two reports that short budgets resolve it. The initial tests report three failures/one pass against main; the later fix report explicitly supersedes that result after strengthening boundaries: four failures against main and two failures when closeIdle uses 15s again. This is direct supplied child-report provenance, not an independently rerun mutation experiment. The round-two Opus report also supplies typecheck exit 0 and identifies the lint warning as older code. These support the current draft’s corresponding claims with the stated provenance. Lint has one warning; typecheck transcript has no error diagnostic but no explicit recorded exit status. Neither is a runtime behavior gap. No claim of Windows empirical verification is supported or made.

The phrase “final main merge” should mean the local merge candidate; no forge merge has occurred in this audit. The published forge head remains the original contributor de63f7caa5c47aaead3f6ab554d635d2e303adfd until the parent pushes, so none of this is a current remote-CI certification.


FRICTION retrieval|urllib received HTTP403 for public artifact|curl with a normal User-Agent downloaded the same URL successfully
FRICTION evidence|original close fixtures left a background child alive in both revisions|retain invalid captures and use terminal-owned EXIT/HUP/TERM cleanup in supplemental proof
FRICTION coordination|evidence agent owns source and server during supplemental captures|explicit readiness/release handshake before independent reproduction
FRICTION claims|published body describes superseded timeout/test/error handling|label historical text and put the current implementation and evidence in the authoritative takeover section

Final cumulative git diff --check against latest main passes; HEAD remains cca46259f59d82f31c7277cc2129b4a7185df890 and worktree clean. File-hash inventory covers 182 allowlisted capture files across the 15 inspected captures.

## Verdict

SUFFICIENT for the stated Linux server runtime proof: fast single/twenty, slow single/twenty, bounded hung twenty, and supplemental close-mid-query. Twelve valid captures support those rows (ten original non-close plus two supplemental), and the independent slow run is an additional thirteenth valid capture. The two invalid original close captures remain preserved and excluded from cleanup-success claims. Source hashes bind original AFTER evidence to the final local merge candidate. Body runtime claims reconcile; supplied review/mutation provenance is distinguished above. Windows remains explicitly unverified. This is evidence sufficiency for handoff, not a forge merge or remote-CI approval.

VERDICT: SUFFICIENT fast-1, fast-20, slow-1, slow-20, hung-20, supplemental-close; Windows unverified