# Proof audit pass 1 — issue 24513

Read-only audit of branch `fix/issue-24513`, [0b002c7f45](https://git.cafe/pingdotgg/t3code/commit/0b002c7f45) against [8176b58931](https://git.cafe/pingdotgg/t3code/commit/8176b58931). No repository edits, tests, server, browser, captures, forge comments, pushes, or merges performed by this reviewer. A correction agent is independently fixing the confirmed native-child cleanup regression; this matrix specifies the required final semantics without waiting for that commit. An uncommitted regression test was visible during inspection; its presence is not a passing result.

## Changed code, callers, and conditions

No render files, client code, mobile code, desktop code, or contracts changed. This is nevertheless a visible behavior fix: server events determine the existing interruption divider and folding, so an empty visual matrix would be incorrect.

- [ProviderTurnStartService.ts](https://git.cafe/pingdotgg/t3code/src/commit/0b002c7f45/apps/server/src/orchestration-v2/ProviderTurnStartService.ts): `makeRunControls` captures the initial worktree path; `hasWorkspaceMoved` compares it with the current recovery projection. Read failure becomes false. The root `startRootRun` call supplies this callback. This is shared server behavior, not a Codex-only adapter change.
- [RunExecutionService.ts](https://git.cafe/pingdotgg/t3code/src/commit/0b002c7f45/apps/server/src/orchestration-v2/RunExecutionService.ts): root finalization changes an incoming interrupted terminal to completed only when the callback exists, the worktree path differs, and there is no unpaired interrupt request. Otherwise the terminal remains unchanged. `writeFinalRunEvents` turns completed into run/root waiting pending normal checkpoint completion, while the attempt is completed; do not incorrectly assert immediate persisted run completed at every intermediate milestone.
- The same service cascades interrupted/failed/cancelled terminals into open run-owned native subagents, their turn items and nodes. At the audited commit the normalized completed terminal suppresses this cleanup: confirmed regression, correction in progress. Final behavior must use original interrupted semantics for child cleanup while using completed semantics for the parent. Its existing `openRunOwnedSubagentsTerminal` parameter supports separating the two.
- [WorktreeMcpService.ts](https://git.cafe/pingdotgg/t3code/src/commit/0b002c7f45/apps/server/src/mcp/WorktreeMcpService.ts), unchanged: `t3_worktree_handoff` commits `thread.metadata.update` then queues the continuation; detach terminates the calling provider session. Actual binding plus a continuation that reports its new cwd/branch is the relevant runtime entry point. Merely painting a completed fixture is not a handoff proof.
- [SelectionRestart.integration.test.ts](https://git.cafe/pingdotgg/t3code/src/commit/0b002c7f45/apps/server/src/orchestration-v2/SelectionRestart.integration.test.ts): added adapter-backed metadata-rebind lifecycle test asserts target binding, absence of interrupted/failed root and absence of interrupt-result item. It does not prove actual Codex MCP handoff, actual continuation, browser appearance, or native-child cleanup.

## Existing render consumers affected by new data

| Client path | Caller / condition | Visible consequence |
| --- | --- | --- |
| Web `chat/TimelineV2EventRow.tsx` → `V2LifecycleRow.tsx` | `isV2LifecycleItem`, then `run_interrupt_result` | Danger-tone `TimelineSystemDivider`, “Run interrupted”, detail text. The fix prevents this false item; it does not restyle the divider. |
| Web `chat/MessagesTimeline.logic.ts` → `MessagesTimeline.tsx` | Interrupt request/result excludes interrupted turns from normal folding; latest interrupted run affects stopped label; running→interrupted auto-expands | Successful handoff must use normal settled-turn presentation; no false stopped state or interruption expansion. Existing earlier by-user wording fix on main is not this change. |
| Mobile `lib/threadActivity.ts` → `features/threads/ThreadFeed.tsx` | Interrupt-result summary/icon, interrupted-run folding and latest-run labels; running→interrupted expands | Mobile has its own activity presentation and stopped/fold behavior. Do not claim it renders the identical web red divider. |
| Web `V2LifecycleRow.tsx` / subagent presentation, mobile `threadAgentsPresentation.ts` / `ThreadFeed.tsx` | Projected native-child status drives live/terminal child presentation | Interrupted native children must cease looking live even though parent handoff completes normally. Distinct semantic row, combinable with handoff capture. |

## Smallest complete fixture / proof matrix

“Affected” means observable behavior is intended to change or is at risk in this patch. Controls with no intended visual change may be proven by focused tests. Recordings are mandatory for interaction/time rows; stills can supplement but cannot replace them.

| ID | Affected | Fixture and action | Required outcome | Minimum proof |
| --- | --- | --- | --- | --- |
| H | Yes | Real Linux web app, actual Codex high; root-checkout thread calls `t3_worktree_handoff` with continuation. Observe starting state, successful binding, detach/settlement, continuation start and response identifying target cwd/branch. | Binding and continuation succeed; no false root “Run interrupted” divider or stopped state; old turn settles normally and new work executes in target. Inspect normal fold/expand and retain branch/cwd evidence. | Actual runtime recording at each of 1440 light, 1440 dark, 390 light, 390 dark. One continuous recording per cell can cover H+N. Height can remain 800 if usable; width is CSS viewport width. |
| N | Yes, regression | Same H fixture includes a genuinely running native provider child before parent handoff. Observe child running before detach and terminal afterward; expand child details if required. | Parent follows H. Open run-owned child subagent, turn item, root child node and nested node are interrupted; ingestion closes and no ghost running child/spinner persists. Child interruption must not create a false parent interruption row. | Include transition in the same four runtime recordings as H where feasible; plus correction agent’s focused server regression proving all persisted child/node states and subscription closure. A terminal still alone is insufficient. If real Codex cannot reliably expose a running native child, disclose this runtime proof gap; test proof alone does not become a runtime capture. |
| S | No intended change; guard | Actual unpaired Stop exists while workspace moves, compared with ordinary Stop without move. | Real Stop remains interrupted, emits the proper interrupt result; patch must not relabel it completed. Preserve genuine stopped presentation and child cleanup. | Focused server tests can cover both conditions; no additional captures required because renderer unchanged. If interaction is demonstrated visually, use a recording. |
| U | No intended change; guard | Interrupted terminal without workspace movement; callback absent; recovery lookup fails. Also same-path metadata edit. | Remain interrupted; failed lookup conservatively does not invent successful handoff. | Parameterized focused server tests; collapse these visually identical interrupted states into one control class. |
| T | No intended change; guard | Changed workspace with incoming completed, failed, cancelled; superseded attempt; failure allowing child continuation. | Only eligible interrupted roots normalize. Preserve original failure/cancel behavior, attempt-current safeguards, and children explicitly allowed to continue. Ordinary successful completion stays ordinary. | Focused existing/added service tests; no separate screenshots of identical existing renderers. |

Minimum new visual set: four recordings, combining H and N, rather than separate stills for every phase. Do not multiply identical UI cases by every backend boolean. H and N must remain separate assertions even if sharing recordings. If N requires its own runtime sequence, four additional recordings are required for that sequence, not fabricated composite stills. Supplementary stills are optional final-frame aids.

## Surface relevance and honest reductions

- Reported reproduction is Linux web + Codex. Use that actual provider path for the lead’s single final integrated verification. A 390-wide web capture is responsive web proof, not native mobile proof.
- Desktop wraps these web renderers; no Electron/platform-specific code changed. Repeating the identical renderer in Electron and on every OS adds little evidence. Desktop behavior is inferred from shared code, not independently runtime-verified here.
- Native mobile uses a separate unchanged renderer reading the same projection. It is semantically affected and relevant, but dedicated iOS/Android captures are omitted from this minimum scope because no native render/layout/contract change exists. State this limitation; do not claim native verification. If native runtime evidence is required later, use actual app testing and recordings, not narrow web screenshots.
- Other provider adapters share root finalization when they emit an interrupted terminal after workspace movement. No adapter changed. Prove predicate semantics in service tests; do not claim each provider was exercised. Native-child lifecycle is relevant separately from T3 delegated tasks and must not be substituted by an unrelated top-level child thread.
- No Settings, palette, or keybinding renderer changed. The issue entry is agent MCP handoff; the generic workspace-path predicate is broader than that entry, so same-path and non-handoff move conditions belong in backend controls rather than extra UI screenshots. No new reverse-state control, wire schema, connection transport, or docs guidance is introduced.

## Real-app seeding and evidence constraints

Lead owns the existing dev server at `http://localhost:7463`, using isolated `.t3` state. Reviewer did not contact or operate it. Use its existing seeded project with a disposable root-checkout thread and real Codex high, then create the worktree through the runtime MCP handoff and observe queued continuation. Do not manually inject an interrupt/result or edit DB status to generate “after” evidence. If refreshing baseline data is necessary, lead must first stop its own server and use the supported `vp run migrate-dev-db` copy into isolated `.t3`; never run against live `~/.t3/userdata`, symlink it, or write back to it. No refresh is required merely to satisfy this matrix.

Lead already has genuine main-before evidence at 1280×800 light showing successful handoff plus false red interruption plus continuation. Its URLs were not supplied to this reviewer, so no invented links or verified-artifact claim is made. Keep it as baseline evidence, explicitly label its differing viewport. It does not satisfy the requested 1440/390 light/dark set. Capture comparable before cells if claiming a fully matched before/after matrix; otherwise disclose that comparison coverage is limited. Lead will pass known-before URLs to the capture agent.

The known after attempt with dev hot-restart artifact is rejected and counts as zero accepted after evidence. Capture final after only after correction is stable and the server is settled on the intended commit. Record tested SHA and viewport/theme with each artifact, confirm no hot restart/reconnect contaminated the handoff, and retain runtime thread/cwd/branch association. Source inspection, mocked adapters, static markup, and screenshot substitutes cannot prove actual runtime handoff. No runtime captures or passing tests were produced in this proof-audit pass. Lead owns final integrated test once stable.

## FRICTION

| Category | Happened | Avoidance |
| --- | --- | --- |
| Concurrent correction | Working tree already had an uncommitted native-child regression test from independent work. | Audit committed diff at fixed SHAs; treat working-tree test only as pending intent; do not edit, run, stage, or wait for it. |
| Evidence contamination | Prior after attempt reportedly contains hot-restart artifact and is rejected. | Stable final server/commit before lead recording; discard reconnect/restart-contaminated takes. |
| Coverage mismatch | Existing before is 1280 light, requested target set is 1440/390 × light/dark. | Label baseline dimensions honestly; obtain matched baselines if presenting matched pairs; never relabel or upscale old evidence. |
| Surface inference | Narrow web resembles mobile dimensions but is not native client proof. | Name responsive web explicitly; disclose native/desktop/provider runtime omissions and justify shared-server reduction. |

Temporary artifact for lead cleanup: `/tmp/issue-24513-proof-matrix-pass1.md`. Public upload contains only this audit, no screenshots, tokens, or runtime data.