# Proof audit, pass 1

Candidate: [d0d82a6163](https://git.cafe/pingdotgg/t3code/commit/d0d82a6163), base: [a46f80ee28](https://git.cafe/pingdotgg/t3code/commit/a46f80ee28). Unpublished candidate; no PR inspected or modified.

Scope: only ThreadLaunchService.ts and its existing test file. Read-only source/proof inspection; no tests, browsers, captures, servers, edits to the checkout, pushes, comments, or merges performed. Diff whitespace check passed.

## Visual fixture matrix

Empty: zero changed render paths, zero visual fixture rows, zero required screenshots/recordings. The diff changes server launch normalization and extracts existing base-ref checks into a shared helper. Existing UI interactions are runtime triggers, not changed rendering. No client, contract, provider adapter, platform UI, or styling changes. Server-only red test plus runtime transcript applies.

## Collapsed behavioral fixture matrix

| Row | Conditions/data | Affected callers/interactions | Expected result | Proof/status |
| --- | --- | --- | --- | --- |
| E: unborn fallback | Worktree requested; ordinary project; HEAD absent; base commit absent; no usable origin resolution; no named ref | launch, including callers using the shared service; New worktree + first send | Normalize to root before allocation/persistence; run proceeds; worktreePath null; no initial commit or extra worktree | New real-Git test asserts starting and null path. Before transcript is red. Lead reports candidate web reply OK, null persisted path, absent HEAD, root-only worktree list. |
| C: committed control | Worktree requested; HEAD exists | launch; New worktree + send | Preserve worktree request and provision a separate worktree | Existing Scratch test includes ordinary Git-project control; real remote-base tests cover committed repositories. Before runtime control replies OK. Candidate runtime control not supplied. |
| B: usable base despite absent HEAD | HEAD absent; base resolves as commit (including '-' mapped to '@{-1}'), or startFromOrigin true and remote resolution non-null, or named ref present | launch; shared worktreeBaseResolves helper | Preserve worktree request; let provisioning/Git decide; do not silently choose root | New normalization branches visible in source; no explicit absent-HEAD usable-base case in inspected tests. Remote-base existing tests use a committed HEAD. Focused branch tests desirable; no separate visual evidence needed. |
| U: invalid base in committed repo | HEAD exists; all base resolution paths false | checkWorktreeBase; launch/provisioning | Preserve prior invalid-base handling, rather than fall back to root | Helper extraction preserves precheck decision sequence. Existing failure/retry tests cover provisioning errors generally; no new fixture added for this exact guard. |
| S: Scratch | Worktree requested; Scratch project | launch and stored scheduled-task launch | Keep existing own-folder normalization; short-circuit new Git probe | Existing Scratch launch and scheduled-task tests assert own folder and no createWorktree. |
| N: unchanged strategies | root or existing_worktree | all launch callers | Skip worktree fallback detection | Outer condition unchanged in scope; existing launch tests exercise normal paths. |
| F: failed inspection / missing project | Project absent, or Git/store probe fails | launch; precheck | hasNoWorktreeBase returns false; preserve normal error/provisioning path. Precheck still suppresses probe errors | Explicit source guards; no new focused failure fixture. |
| R: durable reuse | Empty-repo worktree launch accepted, then duplicate/replayed launch; or retry an already persisted failed preparation | launch replay vs preparation retry | New launches persist root strategy before preparation; replay must remain one thread/run. Previously persisted failed worktree retry is distinct and not established as fixed by this diff | Existing generic replay/concurrent-retry tests; no empty-repo replay-specific assertion. Before UI Retry fails. Candidate first launch succeeds, so no corresponding failure Retry is required. |

Platform collapse: server-side Git semantics; supplied integrated runtime is Linux/web. Web, Electron, mobile, remote/tunnel, agent and scheduler callers share the service behavior when they call launch; no client-specific changed path warrants a separate visual fixture. This audit did not inspect caller files, per scope restriction. Provider success requires one real provider runtime; no adapter-specific change requires a provider matrix.

## Minimum runtime evidence set

1. Before, real git-init empty repository, New worktree and identical prompt: preparation fails ref_not_found before provider execution. Retry in that same failed thread also fails. Supplied transcript verifies both.
2. After candidate, same empty repository shape and interaction: provider replies OK; persisted thread worktreePath is null; rev-parse HEAD still fails; worktree list contains only root. Lead reports these observations for thread 45d44ab1-ad9e-4d9f-a71e-0225ba6d2f09. This proves fallback rather than an implicit initial commit or hidden worktree.
3. Committed control with the same interaction/prompt: provider replies OK and a distinct worktree exists. Before transcript verifies this; repeat/record at candidate to substantiate preservation after the change.
4. Focused regression red/green: same no-commits test fails on base and passes on candidate. Before transcript records expected failed vs starting, 1 failed / 39 skipped, red test commit 6f4b9f18fd. Green candidate output not supplied. Test stops at preparation release with provider disabled, so real runtime complements it.

Minimum visual capture set: empty. Runtime text transcripts and test output suffice. No browser rerun or capture requested from reviewer.

Before artifact: [runtime-before.txt](https://gh-file-drop-api-prod-mi5fy3sowv63ufte.pinglabs.workers.dev/f/d0289252ad6a3044/runtime-before.txt).

## Required proof gaps

- Supply green focused regression output at candidate (prefer existing whole-file result if already run); this read-only audit did not execute tests.
- Publish the candidate after transcript containing the lead-reported response, persisted null path, absent HEAD, root-only worktree list, exact candidate SHA, and committed control with a distinct worktree. Candidate fallback is currently lead-attested, not independently inspectable as an artifact.

Additional branch tests for B/F and empty-repo replay strengthen guard coverage but are not demands for a UI matrix or additional browser pass. No concrete implementation defect established by this proof audit. The diff does not establish remediation of old failed preparation retries; do not claim that without separate evidence.

## FRICTION

| category | happened | remedy |
| --- | --- | --- |
| Proof availability | Before artifact is available; candidate fallback is supplied as a lead summary; candidate green test and committed control evidence are absent | Attach existing green output and a consolidated candidate runtime transcript; no extra visual captures |
| Scope | Server-only change could be mistaken for changed UI because reproduction uses New worktree | Keep visual matrix empty and use runtime/test proof |