# Proof matrix — pass 1

Scope: [#22775](https://git.cafe/pingdotgg/t3code/pulls/22775), [GitHub mirror #22775](https://github.com/pingdotgg/t3code/pull/22775). BEFORE [21da3061aa](https://git.cafe/pingdotgg/t3code/commit/21da3061aa006fc852ea4bd84c31ec084a3afa26); AFTER [80d27e96db](https://git.cafe/pingdotgg/t3code/commit/80d27e96db888d3ab0dbf12314f136f4e8b3e9b4). Exact full SHAs: `21da3061aa006fc852ea4bd84c31ec084a3afa26`, `80d27e96db888d3ab0dbf12314f136f4e8b3e9b4`.

Server-state evidence only. No screenshots, themes, viewports, or real Claude quota exhaustion are claimed. BEFORE expectations below are source-derived unless the supplied baseline log establishes them; they are not a dev-server observation. The follow-up baseline used intermediate [34a6a9635a](https://git.cafe/pingdotgg/t3code/commit/34a6a9635aa2d3e764a0650149e8a222ebd7fe9f), not the requested merge-base.

## Fixture notation and exact input recipe

Use independent thread IDs `proof:<row>:<revision>` and unique command/event/message IDs at each step. Let T be the fixture's recorded UTC start and R=T+60 seconds. Record actual ISO timestamps in the transcript. Harness uses TestClock; real server uses actual wall clock. No time mocking is needed on the real server. Construct all DateTime fields with the existing contract constructors.

Seed a synthetic project and thread with the existing seedProject and thread.create shape at runtimeLayer.test.ts:5745 onward. Use existing modelSelection/registry fixture; do not connect a live provider. First dispatch `message.dispatch` with text `Work on this.`, attachments `[]`, dispatchMode `{type:"defer_start"}`, createdBy `user`, creationSource `web`. Read its generated source run L. Through EventSinkV2.write append these exact event shapes (the script must serialize generated IDs and complete payloads):

```ts
{ id: E1, type: "run.updated", threadId, occurredAt: T,
  payload: { ...L, status: "failed", completedAt: T } }
{ id: E2, type: "turn-item.updated", threadId, occurredAt: T,
  payload: { id: errorId, type: "error", threadId, runId: L.id,
    nodeId: L.rootNodeId, providerThreadId: null, providerTurnId: null,
    nativeItemRef: null, parentItemId: null, ordinal: 2, status: "failed",
    title: "Usage limit reached", startedAt: T, completedAt: T, updatedAt: T,
    failure: { class: "usage_limit", message: "Plan limit reached.",
      code: "usageLimitExceeded", retryable: null, resetAt: ISO(R) } } }
```

W(C) means dispatch this command at T+2s, read generated wake W, then append `run.updated` with `{...W,status:"completed",startedAt:T+2s,completedAt:C}` and occurredAt=C:

```json
{"type":"message.dispatch","commandId":"<unique>","threadId":"<thread>","messageId":"<unique>","text":"Background task finished; no further work is needed.","attachments":[],"notification":{"source":{"kind":"background_task"},"outcome":"completed","summary":"Background task finished"},"dispatchMode":{"type":"queue_after_active"},"createdBy":"agent","creationSource":"provider"}
```

The dispatch creates the root notification input; do not fabricate a root input with a mismatched ID. For output variant add the exact `system_notice` + empty-files checkpoint payloads in committed finishBackgroundWake at runtimeLayer.test.ts:5890–5958; post-reset variant instead uses assistant_message text `Finished the remaining implementation and verified the result.`. Output text is not a selector predicate.

A means compute `limitRecoveryCommand(candidate,true,nowMs,false)` then call existing `orchestrator.autoArmLimitRecovery({commandId,threadId,limitRecovery})`. D means at now>=R compute `limitRecoveryCommand(candidate,true,nowMs,false)` and dispatch its returned message command; it has usageLimitContinuationOfRunId=L.id and recovery request identity. Save and repeat that exact command twice to test receipt idempotence. STOP is `{type:"thread.stop",commandId,threadId}`. Manual M is `message.dispatch` with manualContinuationOfRunId selected by `usageLimitBlockedRun(runs,turnItems,null) ?? latestExecutedRun(runs)`, text `Continue where you left off.`, attachments `[]`, dispatchMode `{type:"start_immediately"}`, createdBy `user`, creationSource `web`.

Q means dispatch a user message `Run after recovery.` using queue_after_active and seed its run with `{...Q,queueHeld:true}` via run.updated, as in the committed manual-resume fixture. Record the hold before M. An active wake uses `{...W,status:"running",startedAt:T+2s,completedAt:null}` instead of the completed update.

## Matrix

| Row | Exact history / variation | BEFORE observable (merge-base) | AFTER observable | Changed branch/selector proved | Existing proof and capture requirement |
| --- | --- | --- | --- | --- | --- |
| R1 prearm | L failed; W(T+2s); inspect before A; A; at R D twice | Wake supersedes L; no recovery candidate; shell completed/no usage limit; no automatic continuation | Candidate identifies L, failed/usage_limit/R; shell failed/usage_limit; A stores L; D adds exactly one continuation | Shared completed-notification exclusion; candidate SQL; shell SQL; autoArm input filter; automatic message projection filter | completed-wake-before-arm harness passes; original baseline fails candidate. MUST capture runtime before/after, including shell assertion missing from positive harness case |
| R2 already armed | L; A before wake; W(T+2s); inspect; at R D twice | Stored recovery may remain but latest completed wake prevents due recovery | Candidate still L; requestId unchanged; one continuation, no duplicate | Same selectors plus preserved armed identity and generic command projection notification loading | completed-wake-after-arm harness passes; original baseline fails due candidate. MUST capture runtime before/after |
| R3 Stop before arm | L; W(T+2s); STOP; attempt automatic A; inspect; explicitly dispatch arm metadata; at R D twice | Stop reaches wake; cannot seed disarmed L recovery; candidate already absent due original bug | L marked stopped; limitRecovery L/R/autoResume:false/requestId=STOP; automatic A cannot override; explicit rearm works once | holdStoppedThread blocked-source fallback, full root-input/error read, markStoppedRun | completed-wake-stop-before-arm passes; follow-up baseline fails on intermediate SHA. MUST capture runtime before/after; record stopped source event, not only metadata |
| R4 manual + held queue | L; Q held; running wake; M(L); finish wake at T+2s; auto-resume off; at R+2s select M; repeat with new command/message IDs; queue.resume | Active M rejected; completed wake selected, no failed resumable source; forced M(L) rejected by latestExecuted guard | Active M rejected; after wake select L; M accepted once; Q remains queued, queueHeld=false; duplicate M rejected; queue.resume accepted without jumping active continuation | ChatView resumable selector; manual failed-source guard vs interrupted fallback; generic command input filter and queue precedence | usage_limit_wake manual case passes; follow-up intermediate baseline rejects. MUST capture runtime before/after; selector expression is test evidence, not proof of a rendered button |
| R5 post-reset success | L; A; save due D; W(R+2s) with assistant output; inspect; dispatch stale D then forced M(L) | Success supersedes L; candidate absent, completed shell, stale D no new run, M rejected | Same as BEFORE; recovery metadata may persist but is inert | Reset-time gate in shared helper and BOTH SQL joins; stale auto/manual guards | completed-wake-postreset passes; intermediate baseline wrongly retains L. MUST capture runtime before/after as non-regression boundary |
| R6 active supersession | L; A; W running at R; stale D; forced M(L) | Active wake authoritative; no second active continuation | Same | Exclusion applies only to completed runs; manual failed-source guard | Existing wake scenario and manual active-wake rejection; shared client running case. Tests sufficient; may fold into R4 runtime |
| R7 normal user work | L; completed newer user-first root run at T+2s, with later root notification; shuffle input array | Completed user work supersedes L | Same; ordinal-first user input wins regardless of array order | firstInputs map and SQL ORDER BY ordinal; no broad notification suppression | Committed client test covers user-first, missing input, child-only notification; independent parity log covers SQL. Tests sufficient; no viewport row |
| R8 inclusive reset / invalid dates | L; W completion R-1ms, R, R+1ms; repeat with resetAt null and invalid | All completed wakes supersede | Before/at R preserve L; after R supersedes; null/invalid reset preserves old supersession | <= reset predicate; Date.parse/julianday NULL behavior | Committed client exact-boundary/postreset tests; 28-history SQL/shared parity diagnostic. Tests sufficient; durable SQL boundary table recommended |
| R9 failure and root identity | Latest failure non-limit or missing error; child-only notification; root null; notification-first vs user-first | Existing latest-executed behavior | No revival of older usage limit; only root notification-first qualifies | latest failed/root error joins, class early return, root identity and first-input lookup | Independent parity log plus committed client child/input cases; tests sufficient; diagnostic script was removed, so 28-case parity is not a committed fixture |
| R10 other ordering/guards | Starting/waiting/interrupted/failed/cancelled/queued wake; cancelled-before-start; archive/pending request/settled/Stop/rearm; duplicate D | Existing guards | Preserve guards; interrupted manual continuation still uses latestExecuted; duplicate due dispatch adds one run | Status filter boundaries and ternary manual guard; unchanged worker safety constraints | Existing recovery suite and 28-case parity diagnostic, 99 total affected tests pass. Tests sufficient; duplicate delivery included in R1/R2 captures |

## Minimal capture plan and reproducible seeding

Five paired scenario blocks R1–R5, in one BEFORE transcript and one AFTER transcript, are sufficient. Fold active-wake rejection into R4 and duplicate dispatch into R1/R2. R6–R10 need regression results, not additional server captures. No real Claude limit is necessary for this state-machine proof; real quota exhaustion remains UNVERIFIED.

Least invasive recommendation: retain current committed fixtures/tests; add one committed development/test-only seed-and-capture runner plus a versioned fixture recipe/data file, reusing EventSinkV2 and OrchestratorV2 services and synthetic provider registry. Do NOT add a production RPC, HTTP endpoint or MCP tool. Do not seed direct projection SQL: that bypasses events and cannot prove normal projection behavior. The runner must fail unless its database/home is an explicitly passed disposable directory distinct from ~/.t3/userdata, print all generated commands/events with IDs and ISO dates, and never read real credentials. This runner does not exist yet; this audit does not claim the prose recipe is executable committed evidence.

For an actual dev-server transcript, seed through that runner while the isolated server is stopped, close its database, then start the existing server against exactly that home. Advance scenario stages with server stopped if append-only service seeding needs exclusive ownership; use separate homes per stage if necessary. Observe shell/thread state and dispatch Stop, Resume and metadata commands through existing supported server transport. Record actual bound port, home, PID captured at spawn, server readiness and transport responses. Use existing no-provider/stub facilities if available; otherwise implement the fake at the test runner/provider fixture boundary, not a production adapter or permission surface. Capture persisted continuation-created event as success milestone; drain effects/await specific event, never arbitrary sleeps. Waiting for the real reset deadline is fine, but must be timestamped and followed by an event milestone.

If the runner only instantiates services in-process, label its output ISOLATED EVENT HARNESS, even if it uses real SQL and orchestration. It does not replace the requested dev-server capture. Likewise an offline seed then a server read proves live projection presentation, but continuation delivery must be sent to and observed on the running server to prove the runtime transition.

Each transcript header must include full git SHA, clean/dirty status and fixture runner hash, launch command with credentials redacted, isolated home, server PID/port, fixture schema/version and synthetic provider declaration. For each stage log input command/event then ordered committed event sequence and state: run IDs/statuses, root first-input type, L failure/reset, candidate L identity, shell status/error, limitRecovery including requestId, stopped markers, Q status/hold and continuation count. Capture failures as well as successes on BEFORE; don't abort R1's missing candidate and lose later independent rows. Never relabel intermediate-baseline results as merge-base proof.

Use existing checkout/artifact availability; do not create worktrees or install to obtain BEFORE. If no safe existing merge-base runtime is available under the lead's authorization, report that capture missing rather than mutating the current checkout behind another task. No protected authentication/credentials/permissions/approvals/modes/sandbox/trust/MCP surface needs to change.

## Present evidence status

Read both implement reports and both review-2 reports, full six-file diff, relevant fixture/worker source and supplied logs. Reports independently agree on 99/99 tests at AFTER; original baseline demonstrates R1/R2 failures; follow-up baseline demonstrates four failures at the intermediate SHA. No report supplies a dev-server transcript at either requested SHA. No new tests or server were run in this audit; existing successful checks were not repeated without a new change or unresolved failure. Reviews' MERGE verdicts concern code correctness, not completion of the additional proof requirement.

VERDICT: INSUFFICIENT — missing actual paired dev-server captures R1–R5 and committed reproducible runtime seed/capture runner/data. Real Claude quota exhaustion remains explicitly unverified and is not required for the scoped synthetic state proof.