# Read-only proof audit PASS2

No blocking code or proof finding in the requested server-only scope. Evidence is sufficient for the legacy terminal-history collision fix. This is a proof verdict, not a claim that replacement CI is green or that the original fork PR can merge.

Reviewed [#18671](https://git.cafe/pingdotgg/t3code/pulls/18671) / [#18671](https://github.com/pingdotgg/t3code/pull/18671). Original contribution: `Batuhan1999/t3code:fix/terminal-legacy-history-collision`, [9f70943e77](https://github.com/pingdotgg/t3code/commit/9f70943e771071135c6a7f7caf708a548b3b449b). Pinned before: [909e4c9482](https://github.com/pingdotgg/t3code/commit/909e4c948278afc2b3e1e665075fb1755a13f894). Reviewed replacement: [dc98776633](https://github.com/pingdotgg/t3code/commit/dc98776633a556a05aad14550c89d235d5a0e1e1), `takeover/pr-18671`.

Final-head confirmation: `git rev-parse HEAD` returned [4f9c30a87f](https://github.com/pingdotgg/t3code/commit/4f9c30a87fd3a3114efc66b13a3cac819465f275), integrating main [3cc31ed27c](https://github.com/pingdotgg/t3code/commit/3cc31ed27c8956b36cee35a50509fb7c6869592b). Both terminal files are byte-identical to the reviewed replacement: Manager.ts Git blob `a020bb3c50e77814353894e78d2c1f9f7fca64f1`; Manager.test.ts blob `81d5e2a131e841c0affb59543feb2f6b12fed237`. Final `origin/main...HEAD` diff is still only Manager.ts (+4/-2) and Manager.test.ts (+22). Complete baseline-to-reviewed diff matches the capture's complete.diff. No terminal behavior changed during main integration.

The main merge adds 16 files of auth/session/HTTP/RPC/client authorization/docs changes (+527/-98) relative to the reviewed replacement. These are main changes outside the two-file PR diff. All pass-2 runtime reruns used the final checkout's dependencies; Manager alone was selected from exact requested SHA through the inspected read-only module overlay. Thus the old-SHA reruns establish exact old Manager behavior with final dependencies, not a clean full-tree reconstruction of each historical revision. The final-head RPC run uses final Manager and final dependencies. Driver header text claiming dependencies are from dc is stale for service reruns; this disclosure supersedes it.

The guard excludes sanitized case-insensitive `terminal_` legacy names in read/migration, default-terminal deletion, and whole-thread deletion. Own current files are resolved first. Ordinary legacy and current naming remain intact. Reserving the whole prefix intentionally makes any synthetic old prefixed legacy name unavailable to that actor; treating dotted names as safe would reopen the demonstrated hashed-name collision. The original bot suggestion for that exception is not applicable. Mixed-case regression coverage is present in replacement. Original forge metadata/checks still name the original fork head and report its conflict with main; they do not certify replacement CI or mergeability.

| Row | Status | Evidence checked |
|---|---|---|
| R1 | sufficient | Before migrates owner's bytes into actor; after actor empty, owner retained |
| R2 | sufficient | Default delete before any open; before owner removed, after retained |
| R3 | sufficient | Thread delete before any open; before owner removed, after retained |
| M1 | sufficient, Linux surrogate | Exact mixed-case file consumed before, retained after; lower-case owner copy retained both |
| M2 | sufficient, Linux surrogate | Exact mixed-case file removed before, retained after |
| M3 | sufficient, Linux surrogate | Whole-thread version independently seeded |
| S1 | sufficient | Sanitized reserved prefix exhibits R1 delta |
| S2 | sufficient | Sanitized reserved prefix exhibits R2 delta |
| S3 | sufficient | Sanitized reserved prefix exhibits R3 delta |
| H1 | sufficient | Current hashed owner filename read/migration collision prevented |
| H2 | sufficient | Current hashed owner filename protected from default delete |
| H3 | sufficient | Current hashed owner filename protected from thread delete |
| L1 | sufficient | Ordinary legacy migrates, payload retained, unrelated owner intact both |
| L2 | sufficient | Ordinary legacy default deletion works both |
| L3 | sufficient | Ordinary legacy thread deletion works both |
| C1 | sufficient | Own current takes precedence over legacy; named history loads both |
| C2 | sufficient | Own default and legacy removed, named and unrelated owner retained both |
| C3 | sufficient | Own default, named and legacy removed; unrelated owner retained both |
| P1 | sufficient | Reserved actor's own current/default and named files still load both |
| P2 | sufficient | Actor default removed, named retained; unrelated owner protected after |
| P3 | sufficient | Actor default/named removed; unrelated owner protected after |
| C6-encoded-120-1 | sufficient | Encoded default and 128-char named ID load correctly both |
| C6-encoded-120-2 | sufficient | Default removed, hashed named file retained both |
| C6-encoded-120-3 | sufficient | Encoded default and hashed named file both removed |
| C6-long-300-1 | sufficient | Hashed default/named load both |
| C6-long-300-2 | sufficient | Default removed, named retained both |
| C6-long-300-3 | sufficient | Default/named removed both |
| C6-nested-1 | sufficient | Nested subagent ID default/named load both |
| C6-nested-2 | sufficient | Default removed, named retained both |
| C6-nested-3 | sufficient | Default/named removed both |
| T1 | sufficient | Sequential awaited operations, fresh Manager observation, independent seeds; no timing claim |
| RPC R1 | sufficient | Published before/after and independent before/reviewed-after/final-after raw RPC responses agree |
| RPC R2 | sufficient | Same, explicit terminalId delete before any opens |
| RPC R3 | sufficient | Same, omitted terminalId delete before any opens |
| Tests | sufficient | Published logs read; independently repeated two expected baseline failures and 45/45 final passes |

All six published JSONL transcripts, both original public service transcripts, all six published server logs, four capture scripts, original public driver, complete.diff, verification.json, SHA256SUMS, both published test logs, and baseline test config were read/inspected. Archive hashes validate all 12 listed artifacts; SHA256SUMS does not cover the subsequently appended server logs/capture markdown. Original and capture matrix row objects are exactly equal. Independent pass-2 matrix/C6 row objects are exactly equal to capture rows (headers differ). Verification checked semantic expected file maps, loaded payloads and preserved/deleted names, not merely PASS assertions. Every paired seed equals byte-for-byte. Core RPC seed is eight bytes `6f776e65722d610a`, `owner-a` plus newline. Before PASS means expected defect observed.

Independent reproduction and delta:

- Inspected public downloaded drivers before execution. Original service driver differs from pinned version only by replacing mutable merge-base selection with exact baseline SHA.
- Ran 21 service rows plus nine C6 controls against both exact Manager revisions, fresh homes `/tmp/ev-18671-pass2-matrix-before`, `-matrix-after`, `-c6-before`, `-c6-after`.
- Ran real RPC R1–R3 at pinned baseline and reviewed replacement using `/tmp/ev-18671-pass2-rpc-before` and `-rpc-after`, then R1–R3 explicitly pinned to final head using `-rpc-final`. All nine servers use new databases, isolated HOME, synthetic seed, dev seeding disabled, actual ws dispatcher/auth, WebSocket JSON Effect RPC, real node-pty `/bin/sh`, no provider turns.
- For R1 baseline, actor loads `owner-a\n`, owner loads empty, seed migrates to actor current file. Reviewed/final after: actor empty, owner loads `owner-a\n`, seed file unchanged. For R2/R3 baseline: immediate file map empty, owner history empty. Reviewed/final after: seed remains byte-identical, owner history restored, actor empty. Raw RPC request IDs/methods and Success response histories were checked independently of summary observations.
- `rpc-pass2.mjs` differs from downloaded driver only in launcher/output paths under the audit scratch directory. `rpc-final.mjs` differs from that by only the selected after SHA. Final logs occupy `rerun-rpc-after-R*-server.log`; reviewed-after logs were overwritten by the final rerun, but its complete RPC transcript remains. No RPC actions/assertions changed.
- Repeated baseline regression tests with exact git-show source under external Vite overlay: two expected failures at history assertion (`thread a\n` vs empty), 43 skipped. Final direct `vp test run apps/server/src/terminal/Manager.test.ts`: 45 passed. No repo-wide tests or checks.
- All nine newly spawned server PIDs exited code 130 in driver finally blocks. Independently checked 53 historical/current server and PTY PIDs absent from `/proc`. Logs show migrations 1–69, no recovered agent work, proper shutdown. Readiness 401, diagnostic GET 400 (no upgrade), and shutdown interrupt 503 are expected harness/server lifecycle diagnostics, not failed terminal RPC responses.

Exact rerun commands, all from the sole authorized checkout `/home/ubuntu/wt/pr-18671`:

```sh
node /tmp/ev-18671-pass2-audit/rpc-pass2.mjs before --home-dir /tmp/ev-18671-pass2-rpc-before
node /tmp/ev-18671-pass2-audit/rpc-pass2.mjs after --home-dir /tmp/ev-18671-pass2-rpc-after
node /tmp/ev-18671-pass2-audit/rpc-final.mjs after --home-dir /tmp/ev-18671-pass2-rpc-final
```

Those homes now exist; select new fresh suffixes for another run. Production CLI receives `--base-dir`, translated from driver `--home-dir`. Final driver expects server-launcher.mjs at the audit scratch path; restore both scripts there for exact reproduction. Ephemeral auth text and QR blocks are redacted in published server logs. No auth stores, databases, credentials or live userdata were uploaded.

[Pass-2 scripts, transcripts, tests, verifier and redacted logs](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/75f2f541f41bb353/ev-18671-pass2-artifacts.tar.gz), [final-head driver](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/563312aefb991988/rpc-final.mjs), [final-head RPC transcript](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d33d003115bdb7ab/rerun-final.jsonl).

| FRICTION category | issue | remedy |
|---|---|---|
| checkout revision | Main merged during proof handoff, changing auth/RPC dependencies | Recorded exact final head and both terminal blob identities; independently repeated final-head R1–R3 RPC |
| historical fidelity | Module overlay selects Manager only; dependency-origin header is stale after merge | Explicit final-checkout dependency disclosure; same final dependencies for baseline/reviewed/final comparison |
| fixture revision | Original public service driver derives mutable merge-base | Inspected and used pinned public capture driver |
| artifact paths | RPC driver hardcodes shared scratch launcher/log location | Changed only scratch paths externally; final after rerun changes only selected SHA; disclose overwritten reviewed-after server logs |
| network | One curl DNS failure; Python urllib received HTTP 403 | Bounded curl retry succeeded; no missing input artifacts |
| platform | Linux does not reproduce case-insensitive filesystem aliasing | M1–M3 are disclosed exact-name surrogates, not native macOS/Windows claims |
| test history | Original PR description says 103 tests | Audited current supplied output and independently ran actual 45-test file |
| runtime diagnostics | Readiness/diagnostic/shutdown HTTP statuses resemble errors | Verified raw terminal RPC Success responses and expected lifecycle origin |

No code edits, commits, pushes, PR comments, browser use, or live userdata access. Worktree clean at final check; HEAD unchanged. App-owned PR registration only; no watch. No UI images, diff PNGs or videos required for this server-only dispatcher. Native case-insensitive filesystems, remote/relay/tunnel, frontend surfaces, provider agents and load performance were not exercised. These limits do not leave any requested matrix row without service evidence. Audit performed with GPT-6.1 Sol via Codex in T3 Code; pr-audit, cafe-cli/cafe-pr, and ghdrop skills used.

VERDICT: SUFFICIENT